Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine

Overview

General Information

Sample URL:https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine
Analysis ID:1334820
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

System process connects to network (likely due to code injection or exploit)
Queries the volume information (name, serial number etc) of a device
Drops PE files to the application program directory (C:\ProgramData)
Drops certificate files (DER)
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Creates files inside the system directory
PE file contains sections with non-standard names
Detected potential crypto function
Found potential string decryption / allocating functions
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file does not import any functions
Installs a raw input device (often for capturing keystrokes)
Modifies existing windows services
PE file contains an invalid checksum
Drops PE files
Uses cacls to modify the permissions of files
Drops PE files to the windows directory (C:\Windows)
Binary contains a suspicious time stamp
Contains functionality to retrieve information about pressed keystrokes
Checks for available system drives (often done to infect USB drives)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w7x64
  • cmd.exe (PID: 1372 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine" > cmdline.out 2>&1 MD5: AD7B9C14083B52BC532FBA5948342B98)
    • wget.exe (PID: 1052 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)
  • msiexec.exe (PID: 2496 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\download\EpicInstaller-15.17.1-unrealEngine.msi" MD5: AC2E7152124CEED36846BD1B6592A00F)
  • msiexec.exe (PID: 2588 cmdline: C:\Windows\system32\msiexec.exe /V MD5: AC2E7152124CEED36846BD1B6592A00F)
    • msiexec.exe (PID: 1196 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 0E7DF1322785CF15345485DB47D418B2 C MD5: 4315D6ECAE85024A0567DF2CB253B7B0)
      • rundll32.exe (PID: 3160 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIE717.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5832034 5 CustomActionManaged!CustomActionManaged.CustomActions.ValidatePathLength MD5: 51138BEEA3E2C21EC44D0932C71762A8)
    • msiexec.exe (PID: 3312 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 15A88122D9C7CE3C2ED0F8A7531243D7 MD5: 4315D6ECAE85024A0567DF2CB253B7B0)
      • rundll32.exe (PID: 3352 cmdline: rundll32.exe "C:\Windows\Installer\MSIBBA3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5598267 9 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendStart MD5: 51138BEEA3E2C21EC44D0932C71762A8)
      • rundll32.exe (PID: 3424 cmdline: rundll32.exe "C:\Windows\Installer\MSI9A4F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5720806 15 CustomActionManaged!CustomActionManaged.CustomActions.SetStartupCmdlineArgs MD5: 51138BEEA3E2C21EC44D0932C71762A8)
      • rundll32.exe (PID: 3476 cmdline: rundll32.exe "C:\Windows\Installer\MSIA826.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5724363 21 CustomActionManaged!CustomActionManaged.CustomActions.CheckReparsePoints MD5: 51138BEEA3E2C21EC44D0932C71762A8)
      • rundll32.exe (PID: 3288 cmdline: rundll32.exe "C:\Windows\Installer\MSI9171.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5975009 49 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendEnd MD5: 51138BEEA3E2C21EC44D0932C71762A8)
      • rundll32.exe (PID: 1812 cmdline: rundll32.exe "C:\Windows\Installer\MSI7D38.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5981125 57 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherEpicGamesDirLoc MD5: 51138BEEA3E2C21EC44D0932C71762A8)
      • rundll32.exe (PID: 1444 cmdline: rundll32.exe "C:\Windows\Installer\MSI7F99.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5981733 63 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherInstallDirLoc MD5: 51138BEEA3E2C21EC44D0932C71762A8)
      • rundll32.exe (PID: 1500 cmdline: rundll32.exe "C:\Windows\Installer\MSI822A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5982373 69 CustomActionManaged!CustomActionManaged.CustomActions.SetServiceWrapperDirLoc MD5: 51138BEEA3E2C21EC44D0932C71762A8)
      • rundll32.exe (PID: 3532 cmdline: rundll32.exe "C:\Windows\Installer\MSI8AE2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5984619 75 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendStart MD5: 51138BEEA3E2C21EC44D0932C71762A8)
    • msiexec.exe (PID: 3676 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 9FDD17A1D0B6974DAD5652EADF261855 E Global\MSI0000 MD5: 4315D6ECAE85024A0567DF2CB253B7B0)
      • rundll32.exe (PID: 3712 cmdline: rundll32.exe "C:\Windows\Installer\MSI4E94.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5647220 30 CustomActionManaged!CustomActionManaged.CustomActions.MoveChainerToFolder MD5: 51138BEEA3E2C21EC44D0932C71762A8)
      • icacls.exe (PID: 3168 cmdline: "icacls.exe" "C:\Program Files (x86)\Epic Games\Launcher" /grant "BUILTIN\Users":(OI)(CI)F MD5: 1542A92D5C6F7E1E80613F3466C9CE7F)
      • icacls.exe (PID: 3240 cmdline: "icacls.exe" "C:\ProgramData\Epic" /grant "BUILTIN\Users":(OI)(CI)F MD5: 1542A92D5C6F7E1E80613F3466C9CE7F)
      • rundll32.exe (PID: 3580 cmdline: rundll32.exe "C:\Windows\Installer\MSIA8D2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5812581 97 CustomActionManaged!CustomActionManaged.CustomActions.RegisterProductID MD5: 51138BEEA3E2C21EC44D0932C71762A8)
    • DXSETUP.exe (PID: 3868 cmdline: "C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe" /silent MD5: BF3F290275C21BDD3951955C9C3CF32C)
    • InstallChainer.exe (PID: 2424 cmdline: "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe" 43 "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\EpicOnlineServices.msi" "EOSPRODUCTID=EpicGamesLauncher" "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe" com.epicgames.launcher://unrealEngine MD5: 4A3181A2E93579124799A9B81263768E)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: CrashReportClient.exe.6.drBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_973987e3-6
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Font\Noto_License.txt
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\INF\setupapi.app.log
Source: Binary string: C:\agent\_work\66\s\build\ship\x86\uica.pdb source: MSIE561.tmp.5.dr
Source: Binary string: d:\build\++Portal\Sync\Portal\Source\Installers\EpicOnlineServicesHelper\CustomActionManaged\obj\x86\Release\CustomActionManaged.pdb source: rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, CustomActionManaged.dll.29.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.6.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM source: CrashReportClient.exe.6.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: api-ms-win-core-debug-l1-1-0.dll.6.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.6.dr
Source: Binary string: CrashReportClient.pdb source: CrashReportClient.exe.6.dr
Source: Binary string: XInput1_3.pdb@ source: DXSETUP.exe, 00000012.00000003.576129958.0000000000681000.00000004.00000020.00020000.00000000.sdmp, xinput1_3.dll.18.dr
Source: Binary string: D3DCompiler_43.pdb` source: SET48E7.tmp.18.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: api-ms-win-core-datetime-l1-1-0.dll.6.dr
Source: Binary string: C:\agent\_work\66\s\build\ship\x86\wixca.pdb source: rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, MSIBB25.tmp.6.dr, MSI2176.tmp.5.dr
Source: Binary string: d:\build\++Portal\Sync\Engine\Source\Programs\NotForLicensees\UnrealEngineLauncherInstallChainer\InstallChainer\InstallChainer\obj\x86\Release\InstallChainer.pdb source: InstallChainer.exe, 0000001C.00000000.592187915.0000000001332000.00000020.00000001.01000000.0000001F.sdmp
Source: Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbP source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002BA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, InstallChainer.exe, 0000001C.00000002.654843939.00000000008B2000.00000020.00000001.01000000.00000021.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr
Source: Binary string: %c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%cuser + domain + host name too bigcompiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM source: CrashReportClient.exe.6.dr
Source: Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002BA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, InstallChainer.exe, InstallChainer.exe, 0000001C.00000002.654843939.00000000008B2000.00000020.00000001.01000000.00000021.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr
Source: Binary string: d3dcsx_43.pdb source: SET4760.tmp.18.dr
Source: Binary string: DSETUP.pdb source: DXSETUP.exe, DXSETUP.exe, 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, DSETUP.dll.6.dr
Source: Binary string: DSETUP.pdb0 source: DXSETUP.exe, 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, DSETUP.dll.6.dr
Source: Binary string: d3dx11_43.pdb source: SET45E9.tmp.18.dr
Source: Binary string: d3dx10_43.pdb source: SET4471.tmp.18.dr
Source: Binary string: D3DCompiler_43.pdb source: SET48E7.tmp.18.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr
Source: Binary string: dsetup32.pdb source: DXSETUP.exe, DXSETUP.exe, 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, dsetup32.dll.6.dr
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: api-ms-win-core-file-l2-1-0.dll.6.dr
Source: Binary string: XInput1_3.pdb source: DXSETUP.exe, 00000012.00000003.576129958.0000000000681000.00000004.00000020.00020000.00000000.sdmp, xinput1_3.dll.18.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: api-ms-win-core-console-l1-1-0.dll.6.dr
Source: Binary string: d3dx11_43.pdb@ source: SET45E9.tmp.18.dr
Source: Binary string: d:\build\++Portal\Sync\Engine\Restricted\NotForLicensees\Source\Programs\UnrealEngineLauncherInstaller\CustomActionManaged\obj\x86\Release\CustomActionManaged.pdb source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, CustomActionManaged.dll.15.dr, CustomActionManaged.dll.26.dr
Source: Binary string: DXSETUP.pdb source: DXSETUP.exe, DXSETUP.exe, 00000012.00000000.548355783.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, DXSETUP.exe, 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: z:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: x:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: v:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: t:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: r:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: p:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: n:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: l:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: j:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: h:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: f:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: b:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: y:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: w:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: u:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: s:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: q:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: o:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: m:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: k:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: i:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: g:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: e:
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile opened: c:
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile opened: a:
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A844B1 FindFirstFileA,FindClose,18_2_00A844B1
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_69746CEC FindFirstFileA,FindClose,18_2_69746CEC
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6974B23F FindFirstFileA,GetLastError,FindClose,__fread_nolock,_strnlen,_strnlen,FindFirstFileA,FindClose,18_2_6974B23F
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6974C4A0 _strrchr,FindFirstFileA,FindClose,FindClose,FindFirstFileA,FindClose,_strrchr,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,_strrchr,FileTimeToSystemTime,FileTimeToSystemTime,18_2_6974C4A0
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6974A3CE FindFirstFileA,lstrcmpA,lstrcmpA,GetFileAttributesA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,18_2_6974A3CE
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\Engine
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\NULL
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\Engine\NULL
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\NULL
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\ThirdParty

Networking

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 54.237.117.94 443
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 52.3.21.134 443
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 44.214.116.116 443
Source: NamedLinksV2.json.6.drString found in binary or memory: "URL" : "https://www.facebook.com/UnrealEngine", equals www.facebook.com (Facebook)
Source: NamedLinksV2.json.6.drString found in binary or memory: "URL" : "https://www.youtube.com/unrealengine", equals www.youtube.com (Youtube)
Source: BaseEngine.ini.6.drString found in binary or memory: LoginRedirectUrl="https://www.facebook.com/connect/login_success.html" equals www.facebook.com (Facebook)
Source: BaseEngine.ini.6.drString found in binary or memory: LoginUrl="https://www.facebook.com/`ver/dialog/oauth" equals www.facebook.com (Facebook)
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: BaseEngine.ini.6.drString found in binary or memory: http://127.0.0.1
Source: NamedLinksV2.json.6.drString found in binary or memory: http://Instagram.com/UnrealEngine
Source: App.locres0.6.dr, App.locres1.6.drString found in binary or memory: http://Launcherhelp.epicgames.com
Source: rundll32.exe, 00000020.00000002.612214734.0000000002261000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://api.epicgames.dev
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, Microsoft.Deployment.WindowsInstaller.dll.12.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drString found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: NamedLinksV2.json.6.drString found in binary or memory: http://cafe.naver.com/unrealenginekr
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: wget.exe, 00000002.00000002.386152257.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.425325976.0000000004FC0000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.592022183.00000000050A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004ED0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/server1.crl0
Source: wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: wget.exe, 00000002.00000002.386152257.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.425325976.0000000004FC0000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.592022183.00000000050A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004ED0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: wget.exe, 00000002.00000002.386165991.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386071169.0000000000D59000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D56000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drString found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, Microsoft.Deployment.WindowsInstaller.dll.12.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drString found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: wget.exe, 00000002.00000002.386165991.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386071169.0000000000D59000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/Secti
Source: wget.exe, 00000002.00000003.386021255.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D56000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: rundll32.exe, 0000000B.00000002.425209518.00000000022C0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.00000000024DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://datarouter-weighted.ol.epicgames.com
Source: rundll32.exe, 0000000B.00000002.425209518.00000000022C0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.00000000024DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://datarouter.ol.epicgames.com
Source: rundll32.exe, 00000020.00000002.612214734.0000000002261000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://eos-gateway-ingressv2-prod-c2-w1.befa.live.use1a.on.epicgames.com
Source: MessagingDebugger.uplugin.6.drString found in binary or memory: http://epicgames.com
Source: NamedLinksV2.json.6.drString found in binary or memory: http://i.youku.com/unrealengine
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0%
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0-
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0/
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com05
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, Microsoft.Deployment.WindowsInstaller.dll.12.drString found in binary or memory: http://ocsp.digicert.com0C
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drString found in binary or memory: http://ocsp.digicert.com0K
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, Microsoft.Deployment.WindowsInstaller.dll.12.drString found in binary or memory: http://ocsp.digicert.com0N
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drString found in binary or memory: http://ocsp.digicert.com0O
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net03
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net0D
Source: wget.exe, 00000002.00000003.386021255.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D56000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386060323.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://ocsp.sectigo.com0
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://s.symcd.com06
Source: rundll32.exe, 0000000B.00000002.425209518.0000000002231000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.425209518.00000000022A5000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.00000000024C8000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.0000000002451000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612214734.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612214734.000000000224C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: NamedLinksV2.json.6.drString found in binary or memory: http://weibo.com/unrealengine
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drString found in binary or memory: http://wixtoolset.org
Source: InstallChainer.exeString found in binary or memory: http://wixtoolset.org/
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, InstallChainer.exe, 0000001C.00000002.654843939.00000000008B2000.00000020.00000001.01000000.00000021.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.drString found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, InstallChainer.exe, InstallChainer.exe, 0000001C.00000002.654843939.00000000008B2000.00000020.00000001.01000000.00000021.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.drString found in binary or memory: http://wixtoolset.org/news/
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, InstallChainer.exe, InstallChainer.exe, 0000001C.00000002.654843939.00000000008B2000.00000020.00000001.01000000.00000021.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.drString found in binary or memory: http://wixtoolset.org/releases/
Source: InstallChainer.exeString found in binary or memory: http://wixtoolset.org/telemetry/v
Source: DXSETUP.exe, 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmp, dsetup32.dll.6.drString found in binary or memory: http://www.BetaPlace.com
Source: DXSETUP.exe, 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.BetaPlace.com.
Source: DXSETUP.exe, 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.BetaPlace.com.?
Source: DXSETUP.exe, 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.BetaPlace.comEContinuare
Source: dsetup32.dll.6.drString found in binary or memory: http://www.betaplace.com
Source: DXSETUP.exe, 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmp, DXSETUP.exe, 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmp, dsetup32.dll.6.drString found in binary or memory: http://www.betaplace.com.
Source: BrutalType-Regular.otf.6.drString found in binary or memory: http://www.brownfox.orgAs
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: http://www.digicert.com/CPS0
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: CrashReportClient.exe.6.drString found in binary or memory: http://www.google.comDUMPREQFLUSHD:/build/
Source: NamedLinksV2.json.6.drString found in binary or memory: http://www.twitch.tv/unrealengine
Source: CrashReportClient.exe.6.dr, line_loose_cj.brk.6.dr, line.brk.6.drString found in binary or memory: http://www.unicode.org/copyright.html
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://accounts.epicgames.com
Source: AlertMessagesV2.json.6.drString found in binary or memory: https://accounts.epicgames.com/requestPasswordReset?lang=
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://accounts.launcher-website-prod07.ol.epicgames.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://accounts.unrealengine.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://answers.unrealengine.com
Source: rundll32.exe, 00000020.00000002.612214734.000000000224C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.epicgame
Source: rundll32.exe, 00000020.00000002.612214734.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612214734.000000000224C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.epicgames.dev
Source: rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612214734.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, CustomActionManaged.dll.29.drString found in binary or memory: https://api.epicgames.dev/
Source: rundll32.exe, 00000020.00000002.612214734.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612003197.0000000000543000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.epicgames.dev/telemetry/data?SessionID=
Source: rundll32.exe, 00000020.00000002.612214734.000000000221F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.epicgames.dev/telemetry/data?SessionID=%7B8A5B4BC9-909F-418C-894B-8EF1B08F3145%7D&AppID=
Source: BaseEngine.ini.6.drString found in binary or memory: https://api.twitch.tv/kraken
Source: BaseEngine.ini.6.drString found in binary or memory: https://api.twitch.tv/kraken/oauth2/authorize
Source: BaseEngine.ini.6.drString found in binary or memory: https://api.twitch.tv/kraken/oauth2/revoke
Source: CrashReportClient.exe.6.drString found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: https://d.symcb.com/cps0%
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: https://d.symcb.com/rpa0
Source: rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: https://d.symcb.com/rpa0.
Source: rundll32.exe, 0000000B.00000002.425209518.00000000022A5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://datarouter.ol.epicgameT
Source: rundll32.exe, 0000001A.00000002.591805215.00000000024C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://datarouter.ol.epicgameTZ
Source: rundll32.exe, 0000000B.00000002.425209518.0000000002231000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.425209518.00000000022A5000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.00000000024C8000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.0000000002451000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://datarouter.ol.epicgames.com
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.425209518.0000000002231000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.0000000002451000.00000004.00000800.00020000.00000000.sdmp, CustomActionManaged.dll.15.dr, CustomActionManaged.dll.26.drString found in binary or memory: https://datarouter.ol.epicgames.com/
Source: rundll32.exe, 0000000B.00000002.425101981.00000000003B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.425209518.0000000002231000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.0000000000641000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.0000000002451000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://datarouter.ol.epicgames.com/datarouter/api/v1/public/data?SessionID=
Source: rundll32.exe, 0000001A.00000002.591805215.000000000249F000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.0000000002451000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://datarouter.ol.epicgames.com/datarouter/api/v1/public/data?SessionID=%7BAD312570-80D0-43AB-9C
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://dev.epicgames.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://docs.unrealengine.com
Source: cmdline.out.0.drString found in binary or memory: https://epicgames-download1.akamaized.net/Builds/UnrealEngineLauncher/Installers/Win32/EpicInstaller
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://epicgames.com
Source: CrashReportClient.exe.6.drString found in binary or memory: https://epicsupport.force.com/unrealengine/s/
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://fortnitehelp.epicgames.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://forums.unrealengine.com
Source: NamedLinksV2.json.6.drString found in binary or memory: https://github.com/EpicGames/Signup
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://help.unrealtournament.com
Source: wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.drString found in binary or memory: https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLau
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://launcher.store.epicgames.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://launcherhelp.epicgames.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://paragonhelp.epicgames.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://publish.unrealengine.com
Source: wget.exe, 00000002.00000002.386165991.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386071169.0000000000D59000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D56000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drString found in binary or memory: https://sectigo.com/CPS0
Source: rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://shadowcomplexhelp.epicgames.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://store.epicgames.com
Source: NamedLinksV2.json.6.drString found in binary or memory: https://trello.com/b/GXLc34hk/epic-games-store-roadmap
Source: NamedLinksV2.json.6.drString found in binary or memory: https://trello.com/b/gHooNW9I/ue4-roadmap
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://twinmotionhelp.epicgames.com
Source: NamedLinksV2.json.6.drString found in binary or memory: https://twitter.com/unrealengine
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://ue-launcher-website-prod.ol.epicgames.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://unrealstudiohelp.epicgames.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://wiki.unrealengine.com
Source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, Microsoft.Deployment.WindowsInstaller.dll.12.drString found in binary or memory: https://www.digicert.com/CPS0
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://www.twinmotion.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://www.unrealengine.com
Source: NamedBaseUrls.json.6.drString found in binary or memory: https://www.unrealengine.com/twinmotion
Source: NamedLinksV2.json.6.drString found in binary or memory: https://www.youtube.com/unrealengine
Source: CrashReportClient.exe.6.drBinary or memory string: GetRawInputDatamemstr_cb8f5fa4-5
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A84D57 CreateMutexA,GetLastError,SetErrorMode,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,DirectXSetupSetCallback,DirectXSetupSetCallback,DirectXSetupA,GetAsyncKeyState,ExitWindowsEx,#17,FreeLibrary,GetLastError,DirectXSetupA,GetLastError,FreeLibrary,GetLastError,GetLastError,CloseHandle,CloseHandle,EnumWindows,18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx10_43_x86.catJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Users\user\AppData\Local\Temp\DX49EC.tmp\xinput1_3_x86.catJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx11_43_x86.catJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dcsx_43_x86.catJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Users\user\AppData\Local\Temp\DX49EC.tmp\D3DCompiler_43_x86.catJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSIBB25.tmp
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A84D57 CreateMutexA,GetLastError,SetErrorMode,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,DirectXSetupSetCallback,DirectXSetupSetCallback,DirectXSetupA,GetAsyncKeyState,ExitWindowsEx,#17,FreeLibrary,GetLastError,DirectXSetupA,GetLastError,FreeLibrary,GetLastError,GetLastError,CloseHandle,CloseHandle,EnumWindows,18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A86964 GetSystemDirectoryA,GetLastError,#17,ExitWindowsEx,18_2_00A86964
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5ad366.msi
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C154882_2_00C15488
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C270BB2_2_00C270BB
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1E95B2_2_00C1E95B
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A8EE9B18_2_00A8EE9B
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A9503D18_2_00A9503D
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A8940018_2_00A89400
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A9492118_2_00A94921
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A956FC18_2_00A956FC
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A94E6A18_2_00A94E6A
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A943D818_2_00A943D8
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_697569F218_2_697569F2
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6974C4A018_2_6974C4A0
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6975231018_2_69752310
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_69754FC118_2_69754FC1
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6C09DD9D18_2_6C09DD9D
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6C098B3018_2_6C098B30
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeCode function: 28_2_008B346528_2_008B3465
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeCode function: 28_2_0045105028_2_00451050
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: String function: 00A8ABA8 appears 31 times
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: String function: 69746210 appears 91 times
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: String function: 697522A4 appears 34 times
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: String function: 6C0964D5 appears 57 times
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: String function: 69746391 appears 138 times
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: String function: 00A8390A appears 59 times
Source: api-ms-win-core-heap-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-2-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.6.drStatic PE information: No import functions for PE file found
Source: C:\Windows\SysWOW64\wget.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
Source: C:\Windows\SysWOW64\wget.exeMemory allocated: 771D0000 page execute and read and writeJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\icacls.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\icacls.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\icacls.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\icacls.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 771D0000 page execute and read and write
Source: C:\Windows\SysWOW64\wget.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine"
Source: unknownProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\download\EpicInstaller-15.17.1-unrealEngine.msi"
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 0E7DF1322785CF15345485DB47D418B2 C
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIE717.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5832034 5 CustomActionManaged!CustomActionManaged.CustomActions.ValidatePathLength
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 15A88122D9C7CE3C2ED0F8A7531243D7
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIBBA3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5598267 9 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendStart
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI9A4F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5720806 15 CustomActionManaged!CustomActionManaged.CustomActions.SetStartupCmdlineArgs
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIA826.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5724363 21 CustomActionManaged!CustomActionManaged.CustomActions.CheckReparsePoints
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9FDD17A1D0B6974DAD5652EADF261855 E Global\MSI0000
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI4E94.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5647220 30 CustomActionManaged!CustomActionManaged.CustomActions.MoveChainerToFolder
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe "C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe" /silent
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "icacls.exe" "C:\Program Files (x86)\Epic Games\Launcher" /grant "BUILTIN\Users":(OI)(CI)F
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "icacls.exe" "C:\ProgramData\Epic" /grant "BUILTIN\Users":(OI)(CI)F
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI9171.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5975009 49 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendEnd
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe" 43 "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\EpicOnlineServices.msi" "EOSPRODUCTID=EpicGamesLauncher" "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe" com.epicgames.launcher://unrealEngine
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI7D38.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5981125 57 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherEpicGamesDirLoc
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI7F99.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5981733 63 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherInstallDirLoc
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI822A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5982373 69 CustomActionManaged!CustomActionManaged.CustomActions.SetServiceWrapperDirLoc
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI8AE2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5984619 75 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendStart
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIA8D2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5812581 97 CustomActionManaged!CustomActionManaged.CustomActions.RegisterProductID
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine" Jump to behavior
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 0E7DF1322785CF15345485DB47D418B2 C
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 15A88122D9C7CE3C2ED0F8A7531243D7
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9FDD17A1D0B6974DAD5652EADF261855 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe "C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe" /silent
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe" 43 "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\EpicOnlineServices.msi" "EOSPRODUCTID=EpicGamesLauncher" "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe" com.epicgames.launcher://unrealEngine
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIE717.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5832034 5 CustomActionManaged!CustomActionManaged.CustomActions.ValidatePathLength
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIBBA3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5598267 9 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendStart
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI9A4F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5720806 15 CustomActionManaged!CustomActionManaged.CustomActions.SetStartupCmdlineArgs
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIA826.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5724363 21 CustomActionManaged!CustomActionManaged.CustomActions.CheckReparsePoints
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI9171.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5975009 49 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendEnd
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI7D38.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5981125 57 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherEpicGamesDirLoc
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI7F99.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5981733 63 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherInstallDirLoc
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI822A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5982373 69 CustomActionManaged!CustomActionManaged.CustomActions.SetServiceWrapperDirLoc
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI8AE2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5984619 75 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendStart
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI4E94.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5647220 30 CustomActionManaged!CustomActionManaged.CustomActions.MoveChainerToFolder
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "icacls.exe" "C:\Program Files (x86)\Epic Games\Launcher" /grant "BUILTIN\Users":(OI)(CI)F
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "icacls.exe" "C:\ProgramData\Epic" /grant "BUILTIN\Users":(OI)(CI)F
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIA8D2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5812581 97 CustomActionManaged!CustomActionManaged.CustomActions.RegisterProductID
Source: C:\Windows\SysWOW64\wget.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\InProcServer32Jump to behavior
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A84163 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,FreeLibrary,GetLastError,18_2_00A84163
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\cmdline.outJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSI2176.tmp
Source: CrashReportClient.exe.6.drBinary string: 4: Use Windows functions, use names such as DirectX Device (newest, most promising)r.DriverDetectionMethodLogThreadingWindowsD:\build\++Portal\Sync\Engine\Source\Runtime\Core\Public\GenericPlatform/GenericPlatformProcess.hURLParmsWindows (unknown version)Windows 2000ProfessionalDatacenter ServerAdvanced ServerWindows XPHome EditionWindows Server 2003 R2Windows Storage Server 2003Windows Home ServerProfessional x64 EditionWindows Server 2003Windows VistaWindows Server 2008Windows 7Windows Server 2008 R2Windows 8Windows Server 2012Windows 8.1Windows Server 2012 R2Windows 11Windows 10Windows Server 2022Windows Server 2019ReleaseIdSOFTWARE\Microsoft\Windows NT\CurrentVersion (Release %s)GetProductInfokernel32.dllUltimate EditionHome Premium EditionHome Basic EditionEnterprise EditionBusiness EditionStarter EditionCluster Server EditionDatacenter EditionDatacenter Edition (core installation)Enterprise Edition (core installation)Enterprise Edition for Itanium-based SystemsSmall Business ServerSmall Business Server Premium EditionStandard EditionStandard Edition (core installation)Web Server Edition(type unknown)64bit32bit%d.%d.%d.%d.%d.%sPureVirtualFunctionCalledWhileRunningAppPure virtual function being called while application was running (GIsRunning == 1).Pure virtual function being calledError_ResolutionTooLowLaunchThe current resolution is too low to run this game.Computer: %sCPU Page size=%i, Cores=%iHigh frequency timer resolution =%f MHzConsoleCtrl RequestExit*** INTERRUPTED *** : SHUTTING DOWN*** INTERRUPTED *** : CTRL-C TO FORCE QUITntdll.dllRtlAreLongPathsEnabledAttempting to run KillAllPopUpBlockingWindowsKillAllPopUpBlockingWindows.batWin RequestExitOutBuffer && BufferCountCoCreateGuid( (GUID*)&Result )==((HRESULT)0L)No to AllYes to AllNoToAllYesToAllIsWow64Processkernel32usehyperthreading-corelimit=SoftwareFWindowsPlatformMisc::SetStoredValue: ERROR: Could not store value for '%s'. Error Code %u: %sDevice DescriptionDriverDesc\SettingsProviderNameNVIDIAAdvanced Micro DevicesIntelDriverVersionCatalyst_VersionCatalyst RadeonSoftwareEditionRadeonSoftwareVersionDriverDateEnumDisplayDevices: %d. '%s' (P:%d D:%d)JumpOverNonPrimary \Registry\Machine\\HKEY_LOCAL_MACHINE\GetVideoDriverDetailsInvalid PrimaryIsNotTheChoosenAdapter PrimaryDriverLocationFailed FoundDriverCount:%d DebugString: %sSYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\%04dFoundDriverCount:%d FallbackToPrimary \Device\Video0HARDWARE\DEVICEMAP\VIDEOQueryForPrimaryFailed MachineGuidSoftware\Microsoft\CryptographyDefaultProviderNameStreamingInstallData
Source: classification engineClassification label: mal48.evad.win@41/1105@0/7
Source: C:\Windows\System32\msiexec.exeFile read: C:\Windows\win.ini
Source: CustomActionManaged.dll.11.dr, CustomActions.csSuspicious method names: .CustomActions.GetAnalyticsPayload
Source: CustomActionManaged.dll.8.dr, CustomActions.csSuspicious method names: .CustomActions.GetAnalyticsPayload
Source: CustomActionManaged.dll.8.dr, AnalyticsPayload.csSuspicious method names: .AnalyticsPayload.GetActionEndAnalyticsPayloadString
Source: CustomActionManaged.dll.8.dr, AnalyticsPayload.csSuspicious method names: .AnalyticsPayload.GetActionStartAnalyticsPayloadString
Source: CustomActionManaged.dll.8.dr, AnalyticsPayload.csSuspicious method names: .AnalyticsPayload.GetActionUpgradeStartAnalyticsPayloadString
Source: CustomActionManaged.dll.8.dr, AnalyticsPayload.csSuspicious method names: .AnalyticsPayload.GetCompactedJsonString
Source: CustomActionManaged.dll.8.dr, AnalyticsPayload.csSuspicious method names: .AnalyticsPayload.GetActionUpgradeEndAnalyticsPayloadString
Source: CustomActionManaged.dll.11.dr, AnalyticsPayload.csSuspicious method names: .AnalyticsPayload.GetActionEndAnalyticsPayloadString
Source: CustomActionManaged.dll.11.dr, AnalyticsPayload.csSuspicious method names: .AnalyticsPayload.GetActionStartAnalyticsPayloadString
Source: CustomActionManaged.dll.11.dr, AnalyticsPayload.csSuspicious method names: .AnalyticsPayload.GetActionUpgradeStartAnalyticsPayloadString
Source: CustomActionManaged.dll.11.dr, AnalyticsPayload.csSuspicious method names: .AnalyticsPayload.GetCompactedJsonString
Source: CustomActionManaged.dll.11.dr, AnalyticsPayload.csSuspicious method names: .AnalyticsPayload.GetActionUpgradeEndAnalyticsPayloadString
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A8390A __wstrtime,__wstrtime,_strrchr,FormatMessageA,LocalFree,GetLastError,18_2_00A8390A
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIE717.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5832034 5 CustomActionManaged!CustomActionManaged.CustomActions.ValidatePathLength
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeMutant created: \Sessions\1\BaseNamedObjects\DSETUP32 DLL Mutex
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeMutant created: \Sessions\1\BaseNamedObjects\DXUPDATE DLL Mutex
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeMutant created: \Sessions\1\BaseNamedObjects\***DirectXSetupA***
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeMutant created: \Sessions\1\BaseNamedObjects\DSETUP DLL Mutex
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeMutant created: \Sessions\1\BaseNamedObjects\DirectX Setup
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_69747D53 iDirectXSetupGetEULAA,SetLastError,SetLastError,FindResourceA,GetLastError,SizeofResource,SetLastError,LoadResource,GetLastError,LockResource,SetLastError,18_2_69747D53
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: WinMain18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: WinMain18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: WinMain18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: WinMain18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: WinMain18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: dsetup.dll18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: DirectXSetupA18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: FreeLibrary()18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: WinMain18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: WinMain18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: WinMain18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: WinMain18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: FreeLibrary()18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: WinMain18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: LoadLibrary()18_2_00A84D57
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCommand line argument: WinMain18_2_00A84D57
Source: CrashReportClient.exe.6.drBinary or memory string: .Target.cs.Build.csSourceIntermediate/TargetInfo.json-Mode=QueryTargets -Project="%s" -Output="%s"Unable to read target info for %s.slnUnreal ProjectsUnrealEngineLauncher/LauncherInstalled.datUE_4.040003UE_4.11040003InstallationListInstallLocationUnrealEngineLauncher/Data/Manifests/%s.manifestCustomFieldsInstallLocation*.upluginIntermediate5.0EASaved/ConfigEditorGameAgnosticCreatedProjectPathsRecentlyOpenedProjectFiles(ProjectName="/Templates/
Source: CrashReportClient.exe.6.drBinary or memory string: SOFTWARE\SOFTWARE\Wow6432Node\MSBuild/14.0/bin/MSBuild.exeMSBuild.exeMSBuildToolsPathMicrosoft\MSBuild\ToolsVersions\14.0MSBuild\15.0\bin\MSBuild.exe15.0Microsoft\VisualStudio\SxS\VS7Microsoft\MSBuild\ToolsVersions\12.0Microsoft\MSBuild\ToolsVersions\4.0Building UnrealBuildTool in %s...Project file not found at %sCouldn't find MSBuild installation; skipping./nologo /verbosity:quiet "%s" /property:Configuration=Development /property:Platform=AnyCPURunning: %s %sFailed to start process.Missing %s after buildTargetsEngine/Source/Programs/UnrealBuildTool/UnrealBuildTool.csprojEngine/Config/UnrealBuildToolPlatformPathsEngine/Binaries/DotNET/UnrealBuildTool.exeLauncher.Platform_%sLauncher.Platform_%s.LargeLauncher.Platform_%s.XLargeD:/build/++Portal/Sync/Engine/Source/Developer/DesktopPlatform/Private/PlatformInfo.cppCookFlavorBuildFlavorUnknown platform flag %s in PlatformInfobTargetPlatformCanUseCrashReporterDataDrivenPlatformInfo section [PreviewPlatform %s] must specify a PlatformNamePlatformName != NAME_NoneDataDrivenPlatformInfo section [PreviewPlatform %s] must specify a ShaderFormatItem.ShaderFormat != NAME_NoneEnabledCVarPlatformNameShaderFormatActiveIconPathActiveIconNameInactiveIconPathInactiveIconNameDeviceProfileNameMenuTextMenuTooltipIconTextPlatformInfo PreviewPlatform
Source: C:\Windows\System32\msiexec.exeFile written: C:\ProgramData\Epic\EpicGamesLauncher\Data\EMS\EpicGamesLauncher\PortalRegions.ini
Source: C:\Windows\SysWOW64\wget.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\msiexec.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\msiexec.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Binary string: C:\agent\_work\66\s\build\ship\x86\uica.pdb source: MSIE561.tmp.5.dr
Source: Binary string: d:\build\++Portal\Sync\Portal\Source\Installers\EpicOnlineServicesHelper\CustomActionManaged\obj\x86\Release\CustomActionManaged.pdb source: rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, CustomActionManaged.dll.29.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.6.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM source: CrashReportClient.exe.6.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: api-ms-win-core-debug-l1-1-0.dll.6.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.6.dr
Source: Binary string: CrashReportClient.pdb source: CrashReportClient.exe.6.dr
Source: Binary string: XInput1_3.pdb@ source: DXSETUP.exe, 00000012.00000003.576129958.0000000000681000.00000004.00000020.00020000.00000000.sdmp, xinput1_3.dll.18.dr
Source: Binary string: D3DCompiler_43.pdb` source: SET48E7.tmp.18.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: api-ms-win-core-datetime-l1-1-0.dll.6.dr
Source: Binary string: C:\agent\_work\66\s\build\ship\x86\wixca.pdb source: rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, MSIBB25.tmp.6.dr, MSI2176.tmp.5.dr
Source: Binary string: d:\build\++Portal\Sync\Engine\Source\Programs\NotForLicensees\UnrealEngineLauncherInstallChainer\InstallChainer\InstallChainer\obj\x86\Release\InstallChainer.pdb source: InstallChainer.exe, 0000001C.00000000.592187915.0000000001332000.00000020.00000001.01000000.0000001F.sdmp
Source: Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbP source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002BA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, InstallChainer.exe, 0000001C.00000002.654843939.00000000008B2000.00000020.00000001.01000000.00000021.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr
Source: Binary string: %c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%cuser + domain + host name too bigcompiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM source: CrashReportClient.exe.6.dr
Source: Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002BA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, InstallChainer.exe, InstallChainer.exe, 0000001C.00000002.654843939.00000000008B2000.00000020.00000001.01000000.00000021.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr
Source: Binary string: d3dcsx_43.pdb source: SET4760.tmp.18.dr
Source: Binary string: DSETUP.pdb source: DXSETUP.exe, DXSETUP.exe, 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, DSETUP.dll.6.dr
Source: Binary string: DSETUP.pdb0 source: DXSETUP.exe, 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, DSETUP.dll.6.dr
Source: Binary string: d3dx11_43.pdb source: SET45E9.tmp.18.dr
Source: Binary string: d3dx10_43.pdb source: SET4471.tmp.18.dr
Source: Binary string: D3DCompiler_43.pdb source: SET48E7.tmp.18.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr
Source: Binary string: dsetup32.pdb source: DXSETUP.exe, DXSETUP.exe, 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, dsetup32.dll.6.dr
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: api-ms-win-core-file-l2-1-0.dll.6.dr
Source: Binary string: XInput1_3.pdb source: DXSETUP.exe, 00000012.00000003.576129958.0000000000681000.00000004.00000020.00020000.00000000.sdmp, xinput1_3.dll.18.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: api-ms-win-core-console-l1-1-0.dll.6.dr
Source: Binary string: d3dx11_43.pdb@ source: SET45E9.tmp.18.dr
Source: Binary string: d:\build\++Portal\Sync\Engine\Restricted\NotForLicensees\Source\Programs\UnrealEngineLauncherInstaller\CustomActionManaged\obj\x86\Release\CustomActionManaged.pdb source: rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, CustomActionManaged.dll.15.dr, CustomActionManaged.dll.26.dr
Source: Binary string: DXSETUP.pdb source: DXSETUP.exe, DXSETUP.exe, 00000012.00000000.548355783.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, DXSETUP.exe, 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B6D4 pushad ; retn 0000h2_2_00C1B6E2
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C16AE0 push ss; ret 2_2_00C16AE2
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B6E8 pushad ; retn 0000h2_2_00C1B712
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B687 pushad ; retn 0000h2_2_00C1B692
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C20E85 push cs; retn 0000h2_2_00C20E86
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B491 pushad ; retn 0000h2_2_00C1B492
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B4A5 pushad ; retn 0000h2_2_00C1B4B2
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C20EAD push cs; retn 0000h2_2_00C20EAE
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B660 pushad ; retn 0000h2_2_00C1B672
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C21061 push cs; retn 0000h2_2_00C21066
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B469 pushad ; retn 0000h2_2_00C1B486
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C23008 push ebx; ret 2_2_00C23009
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C16E13 push es; ret 2_2_00C16E42
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C20E35 push cs; retn 0000h2_2_00C20E36
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B5C1 pushad ; retn 0000h2_2_00C1B5D2
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C16BC6 push es; ret 2_2_00C16BCA
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B7D1 pushad ; retn 0000h2_2_00C1B7D2
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B5E7 pushad ; retn 0000h2_2_00C1B5F2
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B7AC pushad ; retn 0000h2_2_00C1B7B2
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C23178 push ds; ret 2_2_00C23261
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B501 pushad ; retn 0000h2_2_00C1B502
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B508 pushad ; retn 0000h2_2_00C1B532
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1C508 pushad ; ret 2_2_00C1C54E
Source: C:\Windows\SysWOW64\wget.exeCode function: 2_2_00C1B731 pushad ; retn 0000h2_2_00C1B732
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A8ABED push ecx; ret 18_2_00A8AC00
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_697522E9 push ecx; ret 18_2_697522FC
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6C098B11 push ecx; ret 18_2_6C098B24
Source: CrashReportClient.exe.6.drStatic PE information: section name: .uedbg
Source: CrashReportClient.exe.6.drStatic PE information: section name: _RDATA
Source: EpicGamesLauncher.exe.6.drStatic PE information: section name: .uedbg
Source: EpicGamesLauncher.exe.6.drStatic PE information: section name: _RDATA
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A83C3F GetVersionExA,LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,18_2_00A83C3F
Source: MSI9A4F.tmp.6.drStatic PE information: real checksum: 0x34095 should be: 0x434e4
Source: MSIA826.tmp.6.drStatic PE information: real checksum: 0x34095 should be: 0x434e4
Source: CustomActionManaged.dll.8.drStatic PE information: real checksum: 0x0 should be: 0x16c68
Source: MSIBBA3.tmp.6.drStatic PE information: real checksum: 0x34095 should be: 0x434e4
Source: MSIE717.tmp.5.drStatic PE information: real checksum: 0x34095 should be: 0x434e4
Source: CustomActionManaged.dll.11.drStatic PE information: real checksum: 0x0 should be: 0x16c68
Source: api-ms-win-crt-string-l1-1-0.dll.6.drStatic PE information: 0x98A5EE23 [Sun Feb 26 08:00:35 2051 UTC]
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\ProgramData\Epic\EpicGamesLauncher\InstallChainer.exeJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\ProgramData\Epic\EpicGamesLauncher\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE561.tmpJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIA8D2.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE717.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\concrt140.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI9171.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI8AE2.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Users\user\AppData\Local\Temp\DX49EC.tmp\dxupdate.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI8AE2.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSI2176.tmpJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\SysWOW64\SET4760.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI7F99.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI4E94.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\ProgramData\Epic\EpicGamesLauncher\InstallChainer.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\DirectXRedist\dsetup32.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\SysWOW64\SET4471.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\SysWOW64\SET4357.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIA826.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI9A4F.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIBBA3.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\msvcp140_2.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIBBA3.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx11_43.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI7D38.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIA826.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exeJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI9A4F.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIBB25.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE717.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI7F99.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIA8D2.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI7D38.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\SysWOW64\SET48E7.tmpJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dcsx_43.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\CrashReportClient.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIA826.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE717.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIBBA3.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI9171.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI4E94.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\ProgramData\Epic\EpicGamesLauncher\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Users\user\AppData\Local\Temp\DX49EC.tmp\D3DCompiler_43.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Users\user\AppData\Local\Temp\DX49EC.tmp\xinput1_3.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI9A4F.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI822A.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\concrt140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\vccorlib140.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\SysWOW64\SET45E9.tmpJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx10_43.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-console-l1-2-0.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: (copy)Jump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI822A.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI9A4F.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIA8D2.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIBB25.tmpJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI9171.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI7F99.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI8AE2.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIA8D2.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI7D38.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\SysWOW64\SET48E7.tmpJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI8AE2.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIA826.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIBBA3.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\SysWOW64\SET4760.tmpJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI7F99.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI9171.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI4E94.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI4E94.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\SysWOW64\SET4471.tmpJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\SysWOW64\SET4357.tmpJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI9A4F.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI822A.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIA826.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI9A4F.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIBBA3.tmpJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\SysWOW64\SET45E9.tmpJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI7D38.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIBBA3.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSIA826.tmp-\CustomActionManaged.dllJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\Installer\MSI822A.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6974C3A6 GetPrivateProfileStringA,18_2_6974C3A6
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Font\Noto_License.txt
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile created: C:\Windows\INF\setupapi.app.log
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "icacls.exe" "C:\Program Files (x86)\Epic Games\Launcher" /grant "BUILTIN\Users":(OI)(CI)F
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe TID: 2596Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\msiexec.exe TID: 1964Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\msiexec.exe TID: 2880Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3332Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3696Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe TID: 3888Thread sleep time: -180000s >= -30000s
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe TID: 3480Thread sleep time: -120000s >= -30000s
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeEvasive API call chain: GetLocalTime,DecisionNodesgraph_18-28206
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_18-29950
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\concrt140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeDropped PE file which has not been started: C:\Windows\SysWOW64\SET48E7.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\CrashReportClient.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeDropped PE file which has not been started: C:\Windows\SysWOW64\SET4760.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeDropped PE file which has not been started: C:\Windows\SysWOW64\SET4471.tmpJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeDropped PE file which has not been started: C:\Windows\SysWOW64\SET4357.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\concrt140.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeDropped PE file which has not been started: C:\Windows\SysWOW64\SET45E9.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\vccorlib140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\msvcp140_2.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-console-l1-2-0.dllJump to dropped file
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeDropped PE file which has not been started: (copy)Jump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A9152E __get_wpgmptr,VirtualQuery,GetSystemInfo,GetModuleHandleW,GetProcAddress,VirtualAlloc,VirtualProtect,18_2_00A9152E
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A844B1 FindFirstFileA,FindClose,18_2_00A844B1
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_69746CEC FindFirstFileA,FindClose,18_2_69746CEC
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6974B23F FindFirstFileA,GetLastError,FindClose,__fread_nolock,_strnlen,_strnlen,FindFirstFileA,FindClose,18_2_6974B23F
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6974C4A0 _strrchr,FindFirstFileA,FindClose,FindClose,FindFirstFileA,FindClose,_strrchr,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,_strrchr,FileTimeToSystemTime,FileTimeToSystemTime,18_2_6974C4A0
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6974A3CE FindFirstFileA,lstrcmpA,lstrcmpA,GetFileAttributesA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,18_2_6974A3CE
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeAPI call chain: ExitProcess graph end nodegraph_18-26922
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeAPI call chain: ExitProcess graph end nodegraph_18-29187
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeAPI call chain: ExitProcess graph end nodegraph_18-30410
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeAPI call chain: ExitProcess graph end nodegraph_18-29952
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\Engine
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\NULL
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\Engine\NULL
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\NULL
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\ThirdParty
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A83647 GetWindowsDirectoryA,OutputDebugStringA,CreateDirectoryA,GetLastError,__wstrtime,__wstrtime,18_2_00A83647
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A83C3F GetVersionExA,LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,18_2_00A83C3F
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A920B3 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,SetEndOfFile,GetLastError,18_2_00A920B3
Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: page read and write | page guard
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A87E8A SetUnhandledExceptionFilter,18_2_00A87E8A
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A8765E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,18_2_00A8765E
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A91B48 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,__amsg_exit,18_2_00A91B48
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6974FC2E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,18_2_6974FC2E
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6975AACB _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,18_2_6975AACB
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6C096DF2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,18_2_6C096DF2
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_6C0A065C _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,18_2_6C0A065C

HIPS / PFW / Operating System Protection Evasion

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 54.237.117.94 443
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 52.3.21.134 443
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 44.214.116.116 443
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/epicgameslauncherinstaller.msi?productname=unrealengine" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/epicgameslauncherinstaller.msi?productname=unrealengine"
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe "c:\program files (x86)\epic games\launcher\portal\extras\eos\installchainer.exe" 43 "c:\program files (x86)\epic games\launcher\portal\extras\eos\epiconlineservices.msi" "eosproductid=epicgameslauncher" "c:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe" com.epicgames.launcher://unrealengine
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/epicgameslauncherinstaller.msi?productname=unrealengine" Jump to behavior
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe "c:\program files (x86)\epic games\launcher\portal\extras\eos\installchainer.exe" 43 "c:\program files (x86)\epic games\launcher\portal\extras\eos\epiconlineservices.msi" "eosproductid=epicgameslauncher" "c:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe" com.epicgames.launcher://unrealengine
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 0E7DF1322785CF15345485DB47D418B2 C
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 15A88122D9C7CE3C2ED0F8A7531243D7
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9FDD17A1D0B6974DAD5652EADF261855 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe "C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe" /silent
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe" 43 "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\EpicOnlineServices.msi" "EOSPRODUCTID=EpicGamesLauncher" "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe" com.epicgames.launcher://unrealEngine
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIE717.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5832034 5 CustomActionManaged!CustomActionManaged.CustomActions.ValidatePathLength
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIBBA3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5598267 9 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendStart
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI9A4F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5720806 15 CustomActionManaged!CustomActionManaged.CustomActions.SetStartupCmdlineArgs
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIA826.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5724363 21 CustomActionManaged!CustomActionManaged.CustomActions.CheckReparsePoints
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI9171.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5975009 49 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendEnd
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI7D38.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5981125 57 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherEpicGamesDirLoc
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI7F99.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5981733 63 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherInstallDirLoc
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI822A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5982373 69 CustomActionManaged!CustomActionManaged.CustomActions.SetServiceWrapperDirLoc
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI8AE2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5984619 75 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendStart
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSI4E94.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5647220 30 CustomActionManaged!CustomActionManaged.CustomActions.MoveChainerToFolder
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "icacls.exe" "C:\Program Files (x86)\Epic Games\Launcher" /grant "BUILTIN\Users":(OI)(CI)F
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\icacls.exe "icacls.exe" "C:\ProgramData\Epic" /grant "BUILTIN\Users":(OI)(CI)F
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Windows\Installer\MSIA8D2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5812581 97 CustomActionManaged!CustomActionManaged.CustomActions.RegisterProductID
Source: C:\Windows\SysWOW64\wget.exeQueries volume information: C:\Users\user\Desktop\download VolumeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSIE717.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSIE717.tmp-\CustomActionManaged.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSIBBA3.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSIBBA3.tmp-\CustomActionManaged.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI9A4F.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI9A4F.tmp-\CustomActionManaged.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSIA826.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSIA826.tmp-\CustomActionManaged.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI4E94.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI4E94.tmp-\CustomActionManaged.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI9171.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI9171.tmp-\CustomActionManaged.dll VolumeInformation
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeQueries volume information: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe VolumeInformation
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeQueries volume information: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI7D38.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI7D38.tmp-\CustomActionManaged.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI7F99.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI7F99.tmp-\CustomActionManaged.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI822A.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI822A.tmp-\CustomActionManaged.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI8AE2.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSI8AE2.tmp-\CustomActionManaged.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSIA8D2.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Installer\MSIA8D2.tmp-\CustomActionManaged.dll VolumeInformation
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: GetLocaleInfoA,18_2_00A912F5
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: GetLocaleInfoA,18_2_69759F85
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: GetLocaleInfoA,18_2_6C0A1F21
Source: C:\Windows\SysWOW64\wget.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A87499 GetLocalTime,18_2_00A87499
Source: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exeCode function: 18_2_00A83C3F GetVersionExA,LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,18_2_00A83C3F

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
1
Replication Through Removable Media		3
Native API		1
Windows Service		1
Access Token Manipulation		1
Disable or Modify Tools		21
Input Capture		1
System Time Discovery		1
Replication Through Removable Media		11
Archive Collected Data		Exfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
System Shutdown/Reboot
Default Accounts12
Command and Scripting Interpreter		1
Services File Permissions Weakness		1
Windows Service		1
Deobfuscate/Decode Files or Information		LSASS Memory11
Peripheral Device Discovery		Remote Desktop Protocol21
Input Capture		Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)111
Process Injection		2
Obfuscated Files or Information		Security Account Manager4
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)1
Services File Permissions Weakness		1
Timestomp		NTDS26
System Information Discovery		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
File Deletion		LSA Secrets2
Security Software Discovery		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.common22
Masquerading		Cached Domain Credentials1
Virtualization/Sandbox Evasion		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup Items1
Virtualization/Sandbox Evasion		DCSync1
Process Discovery		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
Access Token Manipulation		Proc Filesystem1
Remote System Discovery		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)111
Process Injection		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)1
Services File Permissions Weakness		Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
Compromise Software Dependencies and Development ToolsWindows Command ShellCronCron1
Rundll32		Input CapturePermission Groups DiscoveryReplication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1334820 URL: https://launcher-public-ser... Startdate: 31/10/2023 Architecture: WINDOWS Score: 48 6 msiexec.exe 2->6         started        9 msiexec.exe 2->9         started        12 cmd.exe 1 2->12         started        dnsIp3 55 C:\Windows\Installer\MSIBBA3.tmp, PE32 6->55 dropped 57 C:\Windows\Installer\MSIBB25.tmp, PE32 6->57 dropped 59 C:\Windows\Installer\MSIA826.tmp, PE32 6->59 dropped 67 29 other files (none is malicious) 6->67 dropped 14 msiexec.exe 6->14         started        16 DXSETUP.exe 6->16         started        19 msiexec.exe 6->19         started        24 2 other processes 6->24 93 104.18.38.233 CLOUDFLARENETUS United States 9->93 61 C:\Users\user\AppData\Local\...\MSIE717.tmp, PE32 9->61 dropped 63 C:\Users\user\AppData\Local\...\MSIE561.tmp, PE32 9->63 dropped 65 C:\Users\user\AppData\Local\...\MSI2176.tmp, PE32 9->65 dropped 21 wget.exe 1 12->21         started        file4 process5 dnsIp6 26 rundll32.exe 14->26         started        31 rundll32.exe 14->31         started        33 rundll32.exe 14->33         started        45 5 other processes 14->45 47 C:\Windows\SysWOW64\SET48E7.tmp, PE32 16->47 dropped 49 C:\Windows\SysWOW64\SET4760.tmp, PE32 16->49 dropped 51 C:\Windows\SysWOW64\SET45E9.tmp, PE32 16->51 dropped 53 9 other files (none is malicious) 16->53 dropped 35 rundll32.exe 19->35         started        37 rundll32.exe 19->37         started        39 icacls.exe 19->39         started        41 icacls.exe 19->41         started        87 18.67.65.6 MIT-GATEWAYSUS United States 21->87 89 23.219.154.138 INTERNEXAPERUSAPE United States 21->89 91 8.8.8.8 GOOGLEUS United States 21->91 43 rundll32.exe 24->43         started        file7 process8 dnsIp9 95 44.214.116.116 AMAZON-AESUS United States 26->95 69 Microsoft.Deployme...indowsInstaller.dll, PE32 26->69 dropped 71 C:\Windows\...\CustomActionManaged.dll, PE32 26->71 dropped 101 System process connects to network (likely due to code injection or exploit) 26->101 97 54.237.117.94 AMAZON-AESUS United States 31->97 77 2 other files (none is malicious) 31->77 dropped 99 52.3.21.134 AMAZON-AESUS United States 33->99 79 2 other files (none is malicious) 33->79 dropped 81 4 other files (none is malicious) 35->81 dropped 73 Microsoft.Deployme...indowsInstaller.dll, PE32 37->73 dropped 75 C:\Windows\...\CustomActionManaged.dll, PE32 37->75 dropped 83 2 other files (none is malicious) 43->83 dropped 85 10 other files (none is malicious) 45->85 dropped file10 signatures11

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine0%Avira URL Cloudsafe
https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine0%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
(copy)0%ReversingLabs
(copy)0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll0%ReversingLabs
C:\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe0%ReversingLabs
C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\DirectXRedist\dsetup32.dll0%ReversingLabs
C:\Program Files (x86)\Epic Games\DirectXRedist\dsetup32.dll0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\CrashReportClient.exe0%ReversingLabs
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\CrashReportClient.exe0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-console-l1-1-0.dll0%ReversingLabs
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-console-l1-1-0.dll0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-debug-l1-1-0.dll0%ReversingLabs
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-debug-l1-1-0.dll0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-file-l1-2-0.dll0%ReversingLabs
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-file-l1-2-0.dll0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-handle-l1-1-0.dll0%ReversingLabs
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-handle-l1-1-0.dll0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-heap-l1-1-0.dll0%ReversingLabs
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-heap-l1-1-0.dll0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-libraryloader-l1-1-0.dll0%ReversingLabs
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-libraryloader-l1-1-0.dll0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-namedpipe-l1-1-0.dll0%ReversingLabs
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-namedpipe-l1-1-0.dll0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-string-l1-1-0.dll0%ReversingLabs
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-string-l1-1-0.dll0%VirustotalBrowse
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-synch-l1-1-0.dll0%ReversingLabs
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-synch-l1-1-0.dll0%VirustotalBrowse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://ocsp.sectigo.com00%URL Reputationsafe
http://ocsp.entrust.net030%URL Reputationsafe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl00%URL Reputationsafe
http://www.diginotar.nl/cps/pkioverheid00%URL Reputationsafe
http://ocsp.entrust.net0D0%URL Reputationsafe
https://sectigo.com/CPS00%URL Reputationsafe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t0%URL Reputationsafe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl00%URL Reputationsafe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#0%URL Reputationsafe
https://api.epicgame0%Avira URL Cloudsafe
https://api.epicgames.dev/telemetry/data?SessionID=%7B8A5B4BC9-909F-418C-894B-8EF1B08F3145%7D&AppID=0%Avira URL Cloudsafe
https://api.epicgames.dev/0%Avira URL Cloudsafe
http://www.brownfox.orgAs0%Avira URL Cloudsafe
http://www.BetaPlace.com.?0%Avira URL Cloudsafe
http://www.betaplace.com.0%Avira URL Cloudsafe
https://api.epicgames.dev/telemetry/data?SessionID=0%Avira URL Cloudsafe
http://www.betaplace.com0%Avira URL Cloudsafe
http://www.BetaPlace.comEContinuare0%Avira URL Cloudsafe
https://www.twinmotion.com0%Avira URL Cloudsafe
http://www.betaplace.com0%VirustotalBrowse
http://www.BetaPlace.com.?0%VirustotalBrowse
https://datarouter.ol.epicgameT0%Avira URL Cloudsafe
https://api.epicgames.dev0%Avira URL Cloudsafe
http://127.0.0.10%Avira URL Cloudsafe
http://www.google.comDUMPREQFLUSHD:/build/0%Avira URL Cloudsafe
https://api.epicgames.dev/0%VirustotalBrowse
https://www.twinmotion.com1%VirustotalBrowse
http://www.betaplace.com.0%VirustotalBrowse
https://datarouter.ol.epicgameTZ0%Avira URL Cloudsafe
http://api.epicgames.dev0%Avira URL Cloudsafe
http://127.0.0.11%VirustotalBrowse
http://crt.sectigo.com/Secti0%Avira URL Cloudsafe
https://api.epicgames.dev0%VirustotalBrowse
https://api.epicgames.dev/telemetry/data?SessionID=0%VirustotalBrowse
http://crt.sectigo.com/Secti0%VirustotalBrowse
http://api.epicgames.dev0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://cafe.naver.com/unrealenginekrNamedLinksV2.json.6.drfalse
    		high
    https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauwget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.drfalse
      		high
      https://api.epicgames.dev/rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612214734.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, CustomActionManaged.dll.29.drfalse
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		unknown
      http://Instagram.com/UnrealEngineNamedLinksV2.json.6.drfalse
        		high
        http://ocsp.sectigo.com0wget.exe, 00000002.00000003.386021255.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D56000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386060323.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drfalse
        • URL Reputation: safe
        		unknown
        http://www.twitch.tv/unrealengineNamedLinksV2.json.6.drfalse
          		high
          https://unrealstudiohelp.epicgames.comNamedBaseUrls.json.6.drfalse
            		high
            http://i.youku.com/unrealengineNamedLinksV2.json.6.drfalse
              		high
              http://ocsp.entrust.net03rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              http://www.unicode.org/copyright.htmlCrashReportClient.exe.6.dr, line_loose_cj.brk.6.dr, line.brk.6.drfalse
                		high
                https://dev.epicgames.comNamedBaseUrls.json.6.drfalse
                  		high
                  http://datarouter.ol.epicgames.comrundll32.exe, 0000000B.00000002.425209518.00000000022C0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.00000000024DC000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    https://api.epicgamerundll32.exe, 00000020.00000002.612214734.000000000224C000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.diginotar.nl/cps/pkioverheid0rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://api.epicgames.dev/telemetry/data?SessionID=%7B8A5B4BC9-909F-418C-894B-8EF1B08F3145%7D&AppID=rundll32.exe, 00000020.00000002.612214734.000000000221F000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://publish.unrealengine.comNamedBaseUrls.json.6.drfalse
                      		high
                      http://wixtoolset.org/news/rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, InstallChainer.exe, InstallChainer.exe, 0000001C.00000002.654843939.00000000008B2000.00000020.00000001.01000000.00000021.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.drfalse
                        		high
                        http://www.brownfox.orgAsBrutalType-Regular.otf.6.drfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://www.youtube.com/unrealengineNamedLinksV2.json.6.drfalse
                          		high
                          https://www.unrealengine.com/twinmotionNamedBaseUrls.json.6.drfalse
                            		high
                            https://curl.haxx.se/docs/http-cookies.htmlCrashReportClient.exe.6.drfalse
                              		high
                              https://www.unrealengine.comNamedBaseUrls.json.6.drfalse
                                		high
                                http://www.BetaPlace.com.?DXSETUP.exe, 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpfalse
                                • 0%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                		unknown
                                https://epicgames.comNamedBaseUrls.json.6.drfalse
                                  		high
                                  http://datarouter-weighted.ol.epicgames.comrundll32.exe, 0000000B.00000002.425209518.00000000022C0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.00000000024DC000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://datarouter.ol.epicgames.com/datarouter/api/v1/public/data?SessionID=%7BAD312570-80D0-43AB-9Crundll32.exe, 0000001A.00000002.591805215.000000000249F000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.0000000002451000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://api.epicgames.dev/telemetry/data?SessionID=rundll32.exe, 00000020.00000002.612214734.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612003197.0000000000543000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • 0%, Virustotal, Browse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://fortnitehelp.epicgames.comNamedBaseUrls.json.6.drfalse
                                        		high
                                        http://wixtoolset.orgrundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002180000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001E27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.0000000002327000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001EA7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020E7000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, MSIBB25.tmp.6.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.dr, MSIE561.tmp.5.dr, MSI2176.tmp.5.drfalse
                                          		high
                                          https://accounts.launcher-website-prod07.ol.epicgames.comNamedBaseUrls.json.6.drfalse
                                            		high
                                            https://datarouter.ol.epicgames.com/datarouter/api/v1/public/data?SessionID=rundll32.exe, 0000000B.00000002.425101981.00000000003B1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.425209518.0000000002231000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.0000000000641000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.0000000002451000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://weibo.com/unrealengineNamedLinksV2.json.6.drfalse
                                                		high
                                                http://www.betaplace.com.DXSETUP.exe, 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmp, DXSETUP.exe, 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmp, dsetup32.dll.6.drfalse
                                                • 0%, Virustotal, Browse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://epicgames.comMessagingDebugger.uplugin.6.drfalse
                                                  		high
                                                  http://www.betaplace.comdsetup32.dll.6.drfalse
                                                  • 0%, Virustotal, Browse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://ue-launcher-website-prod.ol.epicgames.comNamedBaseUrls.json.6.drfalse
                                                    		high
                                                    https://accounts.unrealengine.comNamedBaseUrls.json.6.drfalse
                                                      		high
                                                      http://www.BetaPlace.comEContinuareDXSETUP.exe, 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://docs.unrealengine.comNamedBaseUrls.json.6.drfalse
                                                        		high
                                                        https://launcher.store.epicgames.comNamedBaseUrls.json.6.drfalse
                                                          		high
                                                          http://ocsp.entrust.net0Drundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namerundll32.exe, 0000000B.00000002.425209518.0000000002231000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.425209518.00000000022A5000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.00000000024C8000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.0000000002451000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612214734.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612214734.000000000224C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://www.twinmotion.comNamedBaseUrls.json.6.drfalse
                                                            • 1%, Virustotal, Browse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://store.epicgames.comNamedBaseUrls.json.6.drfalse
                                                              		high
                                                              https://forums.unrealengine.comNamedBaseUrls.json.6.drfalse
                                                                		high
                                                                https://datarouter.ol.epicgameTrundll32.exe, 0000000B.00000002.425209518.00000000022A5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://sectigo.com/CPS0wget.exe, 00000002.00000002.386165991.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386071169.0000000000D59000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D56000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                http://crl.entrust.net/server1.crl0rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://api.epicgames.devrundll32.exe, 00000020.00000002.612214734.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612214734.000000000224C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  • 0%, Virustotal, Browse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://api.twitch.tv/krakenBaseEngine.ini.6.drfalse
                                                                    		high
                                                                    https://api.twitch.tv/kraken/oauth2/authorizeBaseEngine.ini.6.drfalse
                                                                      		high
                                                                      https://github.com/EpicGames/SignupNamedLinksV2.json.6.drfalse
                                                                        		high
                                                                        http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/vrundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, InstallChainer.exe, 0000001C.00000002.654843939.00000000008B2000.00000020.00000001.01000000.00000021.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.drfalse
                                                                          		high
                                                                          https://accounts.epicgames.comNamedBaseUrls.json.6.drfalse
                                                                            		high
                                                                            https://trello.com/b/GXLc34hk/epic-games-store-roadmapNamedLinksV2.json.6.drfalse
                                                                              		high
                                                                              https://answers.unrealengine.comNamedBaseUrls.json.6.drfalse
                                                                                		high
                                                                                http://127.0.0.1BaseEngine.ini.6.drfalse
                                                                                • 1%, Virustotal, Browse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://www.google.comDUMPREQFLUSHD:/build/CrashReportClient.exe.6.drfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://paragonhelp.epicgames.comNamedBaseUrls.json.6.drfalse
                                                                                  		high
                                                                                  https://epicsupport.force.com/unrealengine/s/CrashReportClient.exe.6.drfalse
                                                                                    		high
                                                                                    http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0twget.exe, 00000002.00000002.386165991.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386071169.0000000000D59000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D56000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://accounts.epicgames.com/requestPasswordReset?lang=AlertMessagesV2.json.6.drfalse
                                                                                      		high
                                                                                      https://launcherhelp.epicgames.comNamedBaseUrls.json.6.drfalse
                                                                                        		high
                                                                                        http://crl.pkioverheid.nl/DomOvLatestCRL.crl0rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        • URL Reputation: safe
                                                                                        		unknown
                                                                                        http://wixtoolset.org/releases/rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, InstallChainer.exe, InstallChainer.exe, 0000001C.00000002.654843939.00000000008B2000.00000020.00000001.01000000.00000021.sdmp, rundll32.exe, 0000001D.00000003.600863904.0000000001DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000003.602173789.00000000022F0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001F.00000003.603692490.0000000000B00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000003.608558898.0000000001E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000003.624811017.00000000020B0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.12.dr, Microsoft.Deployment.WindowsInstaller.dll.31.dr, Microsoft.Deployment.WindowsInstaller.dll.33.drfalse
                                                                                          		high
                                                                                          https://api.twitch.tv/kraken/oauth2/revokeBaseEngine.ini.6.drfalse
                                                                                            		high
                                                                                            https://datarouter.ol.epicgameTZrundll32.exe, 0000001A.00000002.591805215.00000000024C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://Launcherhelp.epicgames.comApp.locres0.6.dr, App.locres1.6.drfalse
                                                                                              		high
                                                                                              http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#wget.exe, 00000002.00000003.386021255.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386021255.0000000000D56000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.386165991.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535274649.00000000002C5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527650314.0000000002255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.535335654.00000000002B1000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.6.dr, api-ms-win-core-file-l2-1-0.dll.6.dr, api-ms-win-core-handle-l1-1-0.dll.6.dr, api-ms-win-core-rtlsupport-l1-1-0.dll.6.dr, api-ms-win-core-debug-l1-1-0.dll.6.dr, api-ms-win-core-synch-l1-2-0.dll.6.dr, CrashReportClient.exe.6.dr, api-ms-win-core-datetime-l1-1-0.dll.6.drfalse
                                                                                              • URL Reputation: safe
                                                                                              		unknown
                                                                                              https://datarouter.ol.epicgames.com/rundll32.exe, 00000008.00000003.409705918.0000000002240000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.425209518.0000000002231000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000003.422160323.0000000002010000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.428035015.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000003.435986687.0000000001FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.527081372.0000000001F80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000003.588187988.0000000002030000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.0000000002451000.00000004.00000800.00020000.00000000.sdmp, CustomActionManaged.dll.15.dr, CustomActionManaged.dll.26.drfalse
                                                                                                		high
                                                                                                https://shadowcomplexhelp.epicgames.comNamedBaseUrls.json.6.drfalse
                                                                                                  		high
                                                                                                  https://wiki.unrealengine.comNamedBaseUrls.json.6.drfalse
                                                                                                    		high
                                                                                                    http://wixtoolset.org/InstallChainer.exefalse
                                                                                                      		high
                                                                                                      http://wixtoolset.org/telemetry/vInstallChainer.exefalse
                                                                                                        		high
                                                                                                        http://eos-gateway-ingressv2-prod-c2-w1.befa.live.use1a.on.epicgames.comrundll32.exe, 00000020.00000002.612214734.0000000002261000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://twitter.com/unrealengineNamedLinksV2.json.6.drfalse
                                                                                                            		high
                                                                                                            https://datarouter.ol.epicgames.comrundll32.exe, 0000000B.00000002.425209518.0000000002231000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.425209518.00000000022A5000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.00000000024C8000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591805215.0000000002451000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://www.BetaPlace.com.DXSETUP.exe, 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpfalse
                                                                                                                		unknown
                                                                                                                http://api.epicgames.devrundll32.exe, 00000020.00000002.612214734.0000000002261000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                • 0%, Virustotal, Browse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                http://crt.sectigo.com/Sectiwget.exe, 00000002.00000002.386165991.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.386071169.0000000000D59000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • 0%, Virustotal, Browse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://secure.comodo.com/CPS0rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://help.unrealtournament.comNamedBaseUrls.json.6.drfalse
                                                                                                                    		high
                                                                                                                    https://trello.com/b/gHooNW9I/ue4-roadmapNamedLinksV2.json.6.drfalse
                                                                                                                      		high
                                                                                                                      http://crl.entrust.net/2048ca.crl0rundll32.exe, 0000000B.00000002.425101981.000000000040C000.00000004.00000020.00020000.00000000.sdmp, DXSETUP.exe, 00000012.00000002.579925975.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.591637934.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.612438791.0000000004EB7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://www.BetaPlace.comDXSETUP.exe, 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmp, dsetup32.dll.6.drfalse
                                                                                                                          		unknown
                                                                                                                          https://twinmotionhelp.epicgames.comNamedBaseUrls.json.6.drfalse
                                                                                                                            		high

                                                                                                                            World Map of Contacted IPs

                                                                                                                            • No. of IPs < 25%
                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                            • 75% < No. of IPs

                                                                                                                            Public IPs

                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                            8.8.8.8
                                                                                                                            		unknownUnited States
                                                                                                                            		15169GOOGLEUSfalse
                                                                                                                            104.18.38.233
                                                                                                                            		unknownUnited States
                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                            18.67.65.6
                                                                                                                            		unknownUnited States
                                                                                                                            		3MIT-GATEWAYSUSfalse
                                                                                                                            54.237.117.94
                                                                                                                            		unknownUnited States
                                                                                                                            		14618AMAZON-AESUStrue
                                                                                                                            52.3.21.134
                                                                                                                            		unknownUnited States
                                                                                                                            		14618AMAZON-AESUStrue
                                                                                                                            44.214.116.116
                                                                                                                            		unknownUnited States
                                                                                                                            		14618AMAZON-AESUStrue
                                                                                                                            23.219.154.138
                                                                                                                            		unknownUnited States
                                                                                                                            		28032INTERNEXAPERUSAPEfalse

                                                                                                                            General Information

                                                                                                                            Joe Sandbox Version:38.0.0 Ammolite
                                                                                                                            Analysis ID:1334820
                                                                                                                            Start date and time:2023-10-31 12:01:16 +01:00
                                                                                                                            Joe Sandbox Product:CloudBasic
                                                                                                                            Overall analysis duration:0h 10m 55s
                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                            Report type:full
                                                                                                                            Cookbook file name:urldownload.jbs
                                                                                                                            Sample URL:https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine
                                                                                                                            Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                                                                                                                            Number of analysed new started processes analysed:34
                                                                                                                            Number of new started drivers analysed:0
                                                                                                                            Number of existing processes analysed:0
                                                                                                                            Number of existing drivers analysed:0
                                                                                                                            Number of injected processes analysed:0
                                                                                                                            Technologies:
                                                                                                                            • HCA enabled
                                                                                                                            • EGA enabled
                                                                                                                            • AMSI enabled
                                                                                                                            Analysis Mode:default
                                                                                                                            Analysis stop reason:Timeout
                                                                                                                            Detection:MAL
                                                                                                                            Classification:mal48.evad.win@41/1105@0/7
                                                                                                                            EGA Information:
                                                                                                                            • Successful, ratio: 7.1%
                                                                                                                            HCA Information:
                                                                                                                            • Successful, ratio: 100%
                                                                                                                            • Number of executed functions: 308
                                                                                                                            • Number of non-executed functions: 168

                                                                                                                            Warnings

                                                                                                                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe, VSSVC.exe, svchost.exe
                                                                                                                            • Execution Graph export aborted for target InstallChainer.exe, PID 2424 because there are no executed function
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 1444 because it is empty
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 1500 because it is empty
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 1812 because it is empty
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 3160 because it is empty
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 3288 because it is empty
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 3352 because it is empty
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 3424 because it is empty
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 3476 because it is empty
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 3532 because it is empty
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 3580 because it is empty
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 3712 because it is empty
                                                                                                                            • Execution Graph export aborted for target wget.exe, PID 1052 because there are no executed function
                                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                            • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                            • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                            • Report size getting too big, too many NtDeleteKey calls found.
                                                                                                                            • Report size getting too big, too many NtDeleteValueKey calls found.
                                                                                                                            • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                            • Report size getting too big, too many NtQueryDirectoryFile calls found.
                                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                            • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                            • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                            • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                            • Report size getting too big, too many NtSetValueKey calls found.
                                                                                                                            • Report size getting too big, too many NtWriteFile calls found.
                                                                                                                            • Skipping network analysis since amount of network traffic is too extensive

                                                                                                                            Simulations

                                                                                                                            Behavior and APIs

                                                                                                                            TimeTypeDescription
                                                                                                                            12:02:25API Interceptor5355x Sleep call for process: msiexec.exe modified
                                                                                                                            12:02:34API Interceptor49x Sleep call for process: rundll32.exe modified
                                                                                                                            12:03:39API Interceptor136x Sleep call for process: DXSETUP.exe modified
                                                                                                                            12:03:54API Interceptor18x Sleep call for process: icacls.exe modified
                                                                                                                            12:03:59API Interceptor226x Sleep call for process: InstallChainer.exe modified

                                                                                                                            Joe Sandbox View / Context

                                                                                                                            IPs

                                                                                                                            ⊘No context

                                                                                                                            Domains

                                                                                                                            ⊘No context

                                                                                                                            ASNs

                                                                                                                            ⊘No context

                                                                                                                            JA3 Fingerprints

                                                                                                                            ⊘No context

                                                                                                                            Dropped Files

                                                                                                                            ⊘No context

                                                                                                                            Created / dropped Files

                                                                                                                            (copy)

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):81768
                                                                                                                            Entropy (8bit):6.4167890753768395
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:TVeqvNS6T6jxeEsU6b0xZtDDVb9X8u9JA7zitdrz/R8cy/FaeBD:TVeqvNOeFgxZ9DVVtRBy/EeD
                                                                                                                            MD5:77F595DEE5FFACEA72B135B1FCE1312E
                                                                                                                            SHA1:D2A710B332DE3EF7A576E0AED27B0AE66892B7E9
                                                                                                                            SHA-256:8D540D484EA41E374FD0107D55D253F87DED4CE780D515D8FD59BBE8C98970A7
                                                                                                                            SHA-512:A8683050D7758C248052C11AC6A46C9A0B3B3773902CCA478C1961B6D9D2D57C75A8C925BA5AF4499989C0F44B34EAF57ABAFAFA26506C31E5E4769FB3439746
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M..i#Y.i#Y.i#Y.i"Y.i#Y.f~Y.i#Y.f,Y.i#Y.f|Y.i#Y.f.Y.i#Y.fCY.i#Y.f}Y.i#Y.fyY.i#YRich.i#Y........................PE..L...5S.F...........!.........F....................@..........................`..................................................d....0..................h%...@..8....................................&..@...............\............................text...j........................... ..`.data....+..........................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\DirectXRedist\APR2007_xinput_x86.cab

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:Microsoft Cabinet archive data, many, 47342 bytes, 5 files, at 0x44 +A "xinput1_3_x86.cat" +A "xinput1_3.dll", flags 0x4, ID 8235, number 1, extra bytes 20 in head, 3 datablocks, 0x1 compression
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):53302
                                                                                                                            Entropy (8bit):7.985485862279273
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:9cnwcwzHEdb27WH2SfZDNu75ddnVR+ZFaNk0ZT9rHUh:0wb+2eZonQwN9oh
                                                                                                                            MD5:C234DF417C9B12E2D31C7FD1E17E4786
                                                                                                                            SHA1:92F32E74944E5166DB72D3BFE8E6401D9F7521DD
                                                                                                                            SHA-256:2ACEA6C8B9F6F7F89EC51365A1E49FBD0D8C42C53418BD0783DBF3F74A744E6D
                                                                                                                            SHA-512:6CBAE19794533AD9401F92B10BD9549638BA20CE38375DE4F9D0E20AF20D78819E46856151CC6818325AF9AC774B8128E18FBEBD2DA5DA4EFBD417FC2AF51DAB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MSCF...........D...............+ .............H....................(.........6{. .xinput1_3_x86.cat.h?...(.....6.. .xinput1_3.dll......h.....6G. .apr2007_xinput_x86.inf......m.....6G. .xinput1_3_x86.inf./....p.....6G. .xinput1_3_x86_xp.inf.i...T5..CK.y<.....Y.d..H.<3.1....=...`,cbB.f...*R*kB..V..E...,.[$I.R(~g..n........}....<....y>.9.s.....f*&.s)E.F..Cp ..Q...D 0<0.;....R.....3.\...4...F.1QI...........@..O....2.f....I\...a...c4.0.....,...0.!..6.. M...@..:..ocp.A.K6......... .F..!...[....+..,...0n...<..@cl`+Xe^.X.t.$.;{X@.P....@d..N=.....Z..g....&...#...%]....~.........C. #..u...h(.4^.4.... a.a...*#.Z<....%.{..5..n$....P@[..C<01..Y...F.\..[.H.H.l..f.l.X.0...l.4.A....+B.~.|.l.YO0..k}i>~V..O.f...M0n^.?..B..........a.......N.w/==J.{..D@0..Q.....%..@6..Z.|......@@.4..a.....q......t....4v....dI.Ym..^...........[7.XH.8Y.nR..d.<.;O.."k...d.y2aV..4....D...5..B".H~.....+x_o.4....c.#.`..0...v.F4........I.Q$.....x....._..;]...O[....l....?..:.......Q._....2.;.~...NXz

                                                                                                                            C:\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):95576
                                                                                                                            Entropy (8bit):6.500628817584274
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
                                                                                                                            MD5:EB701DEF7D0809E8DA765A752AB42BE5
                                                                                                                            SHA1:7897418F0FAE737A3EBE4F7954118D71C6C8B426
                                                                                                                            SHA-256:2A61679EEEDABF7D0D0AC14E5447486575622D6B7CFA56F136C1576FF96DA21F
                                                                                                                            SHA-512:6FF8433C0DADC0E87D18F04289AB6F48624C908ACBDA506708F5E0F3C9522E9316E587E71F568938067BA9F37F96640B793FDFAA580CAEDC3BF9873DC221271F
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........xx...+...+...+..+...+...+F..+.6k+...+.6x+...+.6{+...+...+...+...+...+...+...+...+...+Rich...+................PE..L......M...........!.....*...N.......k.......@.......................................4....@..........................5..y....*.......p..h............^..X.......H...0................................6..@............................................text...)(.......*.................. ..`.data..../...@......................@....rsrc...h....p.......@..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):517976
                                                                                                                            Entropy (8bit):5.9440274231307315
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
                                                                                                                            MD5:BF3F290275C21BDD3951955C9C3CF32C
                                                                                                                            SHA1:9FD00F3BB8A870112DAE464F555FCD5E7F9200C0
                                                                                                                            SHA-256:8F47D7121EF6532AD9AD9901E44E237F5C30448B752028C58A9D19521414E40D
                                                                                                                            SHA-512:D2C354EE8B6977D01F23C6D2BB4977812BF653EAE25E7A75A7D0A36B588C89FCDBDC2A8087C24D6FF687AFEBD086D4B7D0C92203CE39691B21DAB71EAFD1D249
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..Sf}..f}..f}..A...s}..A...E}..A....}..o._.k}..f}...}....f.g}....g.e}....V.g}....Q.g}..Richf}..................PE..L......M.................b...j.......p....................................... ......t3....@...... ...........................d..........l<..............X............................................4..@...............L............................text....a.......b.................. ..`.data....2...........f..............@....rsrc...l<.......>...z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\DirectXRedist\dsetup32.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1566040
                                                                                                                            Entropy (8bit):6.38739478154395
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24576:CIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXi+:CIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXf
                                                                                                                            MD5:D8FA7BB4FE10251A239ED75055DD6F73
                                                                                                                            SHA1:76C4BD2D8F359F7689415EFC15E3743D35673AE8
                                                                                                                            SHA-256:FB0E534F9B0926E518F1C2980640DFD29F14217CDFA37CF3A0C13349127ED9A8
                                                                                                                            SHA-512:73F633179B1340C1C14D0002B72E44CAB1919D0EF174F307E4BFE6DE240B0B6EF233E67A8B0A0CD677556865EE7B88C6DE152045A580AB9FBF1A50D2DB0673B4
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^..?...?...?...G6..?...?..U?.......?.......?.......?...I>..?...I...?...I...?...I?..?...I8..?..Rich.?..........................PE..L......M...........!................c........................................ ......\.....@.................................$...........P...............X............................................^..@...............h............................text............................... ..`.data....4..........................@....rsrc...P...........................@..@.reloc..D).......*..................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\DirectXRedist\dxupdate.cab

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:Microsoft Cabinet archive data, many, 91192 bytes, 3 files, at 0x44 "dxupdate.dll" "dxupdate.inf", flags 0x4, ID 3666, number 1, extra bytes 20 in head, 8 datablocks, 0x1 compression
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):97152
                                                                                                                            Entropy (8bit):7.99414458916803
                                                                                                                            Encrypted:true
                                                                                                                            SSDEEP:1536:JvknxJRHNYzrAzRstaRGk0jzphvXdy57XwwnNb+vnaI1eYpIKxozNlmn6F5x:JvknxJpNYAzRstaRkz0BwwnNbSa+vp58
                                                                                                                            MD5:D495680ABA28CAAFC4C071A6D0FE55AC
                                                                                                                            SHA1:5885ECE90970EB10B6B95D6C52D934674835929E
                                                                                                                            SHA-256:E18A5404B612E88FA8B403C9B33F064C0A89528DB7EF9A79AA116908D0E6AFED
                                                                                                                            SHA-512:A25C647678661473B99462D7433C1D05AF54823D404476E35315C11C93B3F5ECE92C912560AF0D9EFE8F07E36AE68594362D73ABF5D5DE409A3F0A146FE31A10
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MSCF....8d......D...............R...........8d..H.............................~>.%..dxupdate.dll.02........h=...dxupdate.inf.1...0.....~>.%..dxupdate.cif.T....'..CK.Z}.$.U....;..@.e!.#....G===.=+".?..+.s..l8....o.{....;.+..(...d,..HVd..,......(..[&H.........Y.Y..~..{.gv.vW.'.....^......^...}...1v....2.*.~.......y...a_.....^Z..V?H.Q..bo(..0.Ra...q(..`o....W.....4~...q.?...F.............].....~c...O7^..W..x.?...l.=.~$......'..o;.._.....'u.aK......=..X.........g........~.].[..+..\b._........p.=.....w...%..@.o-.....O2..w...~sn..D_:....G).../e.Q_/....=Y.x........p.0..^....w...A}..'..... ...P.7....3.av...?...Kl.......>t...O`..b.]....x..Y....._...x..}....@.....1.9.o....[.?.......)...g..'.1.i../.^.|..=........x...L.6`...>..,...K./....6...........A.#.?.8.|....?.|......w%K.>@..(.I...9.../....].....%v7.>.....-@.p....E........6...Kc..p?@.....8.|.p/..xg...7...^.(..7..X~?..........#...w...q..U....f.... ..?<.\...}.K.Z.,]+...../..-......e...aO....a9Y......Wg.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\CrashReportClient.exe

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15457232
                                                                                                                            Entropy (8bit):6.624458758309935
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:393216:YEb9f6Ol1FFtm/deMigK39RK8pVeh9sYq4Awc5UCC2hB4P2:YEb9f6Ol1FFo/deMig2R/eh9sYq4Awcp
                                                                                                                            MD5:4E170B44987BF04F7A8EE228110F0447
                                                                                                                            SHA1:653E8495E2528DDC8763BC30927DEF6C8695FA7D
                                                                                                                            SHA-256:CC4BA7AA5570FF9A31E5A2CF78065D6356F1B1F9FFF0B42574D3CE7132AC23EA
                                                                                                                            SHA-512:DC4D3C5538952CAD9252E057BEB986E3E5ACC90E3F49F6B94BEA9F6B802073D89ED80130D39E5FF160D9AC1837A62EE41B7ED547C9A908B5BA46A054C3412866
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............a..a..a.....a...d..a.;B...a.p.e..a.p.b..a.p.d..a.p.`..a...e..a...g..a.....a.w....a...`..a.7.d...a...e..a..g..a..e..a..`..a.=.e..a.....a..`...a.2.d...a.?.d..a.2.e...a.>.d...a.>....a.....a.>.c..a.Rich..a.................PE..L....28e.........."......X...*X..............p....@.................................F2....@.................................,...H.......xh...............9.......... R..T....................S......xR..@............p...............................text...*........................... ..`.uedbg..]........................... ..`.rdata..>.-..p....-..\..............@..@.data.....#..P...2...4..............@..._RDATA...'...p...(...f..............@..@.rsrc...xh.......j..................@..@.reloc..............................@..B........................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-console-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17872
                                                                                                                            Entropy (8bit):7.132558512552857
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mPWfhWFU+Y3DGk8ZpH3GCJErz550iA+Y3DGUw8JN77hhn80Po:zJDGkiRBEklDGo3hFRo
                                                                                                                            MD5:A02AF67BD05CED8DCEC2422C5A368E30
                                                                                                                            SHA1:C00920F5608C41E44496035AB53D137D31626063
                                                                                                                            SHA-256:47490DBE76AC98A7134B8ED6506DC18BED97B4EFB6DB8764B2357D2B7D0B5171
                                                                                                                            SHA-512:0145F5865CC9809CBEB04D7C5783BD23193DAA48275AE2396DDBD5CD3CBA693FC6F5EE6ABACB65DFB1229AD6FCAF7FE700346D4C5726C8EA5A259690262981D7
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L.....R............!......................... ...............................0......J.....@.............................+............ ...................9..............T............................................................................text...+........................... ..`.rsrc........ ......................@..@......R.........;...T...T.........R.........d.................R.....................RSDSy...xy.8.RI.......api-ms-win-core-console-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02......................R.....................(...`...............,...W...................G...o...............................D...s...............5...b...............................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kern

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-debug-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17360
                                                                                                                            Entropy (8bit):7.156517933803656
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mvWfhWo+Y3DGk8ZpH3GCJEFxTq0+4y+Y3DGELu8JN77hhVEY:bTDGkiRBEa14GDG0p3hbEY
                                                                                                                            MD5:08DE2B409864DAEE675885620D34F8FB
                                                                                                                            SHA1:0C598288BB6C0EB1809F210D3850657BC4606B70
                                                                                                                            SHA-256:DD2C5EFA9315F66A6531E93A6B80D13F471D57F1BA86FA2294C6C3274ADC144C
                                                                                                                            SHA-512:DDBE3EC5A802C5E25EFBCEE23795EB9CF3CA47ACEAD97B75E6DDEC1D95E15FF07299606EB8A7288217444A5500D4E1D652F486672AA8AE5BF8449399143842FC
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L..................!......................... ...............................0.......?....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................9...T...T...................d.......................................RSDS....F.B..s.Lz.....api-ms-win-core-debug-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................P...............(...8...H...|...............q.......................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStri

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-file-l1-2-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17360
                                                                                                                            Entropy (8bit):7.163875204083516
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mKWfhW9+Y3DGk8ZpH3GCJErMn3n+Y3DGUTP8JN77hhZpv:IYDGkiRBEmlDGsU3hjt
                                                                                                                            MD5:72591F3EB22ABD6ADD78281FFF3F69BD
                                                                                                                            SHA1:44CC71FE68FB4214690E2BF1A4A37428D0276761
                                                                                                                            SHA-256:5D94FCFCA59CB80E0AE42574CB9F83E8D7D0261A0236097A58C58B8E8E3DFF48
                                                                                                                            SHA-512:970326ECCC59F0FAF754897B2B886848B7D0F6B5AA85AD4E421F2A917358466A45F59A0BCFDDCC8759169897515B80DBFB798D7D807E32020608D3A044D3D060
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L....lC............!......................... ...............................0......E.....@.............................L............ ...................9..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@.....lC.........8...T...T........lC.........d................lC.....................RSDS..T..t..*..].".....api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02.........lC.....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-handle-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17360
                                                                                                                            Entropy (8bit):7.163065573934889
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mHWfhWE+Y3DGk8ZpH3GCJEFx2TjoD+Y3DGEK9S8JN77hhDnCL:fLDGkiRBE+oJDG793h9y
                                                                                                                            MD5:5C4308E0D3C3403694D6FFFEADF282F5
                                                                                                                            SHA1:591075C32583DC1B9E27D6B0D65D56C373EFBD68
                                                                                                                            SHA-256:9E953AE44E72EF5B0476D2D60A05041AF33FEE241BE55621A00CC2C670E8F907
                                                                                                                            SHA-512:D4EEC3AFB4A3F910E49F99338F5056967B2E5F4C7790D3B291DE84FE1600E0B3E0E36ABABE0EC79566B49A960A54D268BF6BD14B4A5D14940E53B666D1D6BACE
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L...L..............!......................... ...............................0......{.....@............................._............ ...................9..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@....L...........:...T...T.......L...........d...............L.......................RSDS.1S..1...OWM+.......api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02....................L.......Z...............(...<...P...................A...|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-heap-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17360
                                                                                                                            Entropy (8bit):7.231261033088047
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mYElOWfhWn+Y3DGk8ZpH3GCJEFxcGcol+Y3DGE7ak8JN77hhRe:kSDGkiRBEnDGpn3hre
                                                                                                                            MD5:2344DF300A500D4A666C14C4AA40DD84
                                                                                                                            SHA1:35337CC8433DD19EC733C4DE328C2FE1C5EC01D0
                                                                                                                            SHA-256:EE731DD2942F063FEC75C1C167AAA63B7C0C03000A95DD96447D456B4240D4FD
                                                                                                                            SHA-512:64760C467C557EB9BA9EA136182CB97FA154CE9E3B670B6F544D52FC09DBBC3C7FA6621F420CC543B340260D29309DDAAF3B851F23055264E17D56BA678D0143
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L....y.?...........!......................... ...............................0............@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....y.?........8...T...T........y.?........d................y.?....................RSDSP[c.0..#...`......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........y.?........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18384
                                                                                                                            Entropy (8bit):7.120276750824231
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mq6vuBL3B+WfhWs+Y3DGk8ZpH3GCJErqt+Y3DGUd8JN77hhg04:PBL3B/XDGkiRBEoDGt3hu04
                                                                                                                            MD5:EF16FE59D3C502687998FE9D6FD6A39C
                                                                                                                            SHA1:0F4E207F2CBB1A7FC38086B16CD5169C2C08D4B9
                                                                                                                            SHA-256:71B7D177D226E66F3937EFA208F30BCD36AA3E4F81C0C4D387704FCBF088E016
                                                                                                                            SHA-512:F5015E4585F4693B9B9A164770DF8FC9CCD0F8350518CE6B1BBBBC3F958505246C86465015E2DC1B3FEB1F4C5EF24345EA4FEF865D7FF9A90D0B67DB335AA92A
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L.....X............!......................... ...............................0............@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@......X.........A...T...T.........X.........d.................X.....................RSDS.M.i.@.........-....api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..............X.....................(...........G...z...............-...\...................=...j...................(...G...g...............7...`...................O...r...............*...Y.......................;...Z...}...................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17360
                                                                                                                            Entropy (8bit):7.212932796153108
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mPWfhWk+Y3DGk8ZpH3GCJEFxz7R0+Y3DGEz8JN77hh5TB:/HDGkiRBE/72DGF3hzV
                                                                                                                            MD5:57FEAB4CAFC94CCDCFEEA84C269D6686
                                                                                                                            SHA1:A7DF1D1E107A8B0E574A4DEE6E3EEA056262A7E8
                                                                                                                            SHA-256:3E3676EC797ECDB1F270E5BF1E884D37CB964D9A65D097FC250C247767255953
                                                                                                                            SHA-512:40218D1C4741F4F79800B9FB431FF041A3FF594723E72E828DEC957947270ADCFE6F31CDC66A20D795B96F308864914B9FADFD598FF0CFA14C3A823A7D658B82
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L...R.............!......................... ...............................0............@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@....R..........=...T...T.......R..........d...............R......................RSDS..k3"1...?F2?..S....api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................R......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-string-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17360
                                                                                                                            Entropy (8bit):7.190387498760807
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mTyMvNWfhWl+Y3DGk8ZpH3GCJEFxGG+Y3DGEd28JN77hhuQ:cyMvqQDGkiRBEpDGyR3hoQ
                                                                                                                            MD5:6D23B1C181DCF0C328444415F0A69CAF
                                                                                                                            SHA1:3865C0112F58E6C5B0138C62FFDD8FC7DC0BDADA
                                                                                                                            SHA-256:D3612DE5A7460FC12F024E3C301C172F286D8CBCA1A890A0EDE65F151DAFA1DA
                                                                                                                            SHA-512:3A5FA387FEB71AC9AE8B9D0E93B56B6DA3E96FABB1597A745025837FD60FDBBB1CBB2803BE1A4E5C46467082E9C56C5100F7A2421764DD62CE9DC499C568DC8D
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L....y.............!......................... ...............................0............@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....y..........:...T...T........y..........d................y......................RSDS...%..E......a.....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................y......x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-synch-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):19408
                                                                                                                            Entropy (8bit):7.080937379143234
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mjfdv3V0dfpkXc0vVazWfhWM+Y3DGk8ZpH3GCJEFxmog55+Y3DGE8Z8JN77hhgnb:adv3VqpkXc0vVaQnDGkiRBE6nDGa3h2b
                                                                                                                            MD5:7EFA8337D01DF82405103E74DEA4AB0F
                                                                                                                            SHA1:6709CE2DD2D0DCF8300B1D3A7B20DD03C676E3E5
                                                                                                                            SHA-256:D29ADF82A3F473292D6882C0FB079940398536B9779CF43BF0BE7F2C9A182E5C
                                                                                                                            SHA-512:7E8D381F97A2DFFF5D58DDA23F8D4941C14EE05C97BB7160CA7201FF6DFA3E44A6319C606335A7D0BA00B3B932C377E72E29CE8C9678CC2F66FE4949735B4010
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L...+.QX...........!......................... ...............................0............@.............................V............ ...................9..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@....+.QX........9...T...T.......+.QX........d...............+.QX....................RSDS.#.wA.o..=K. ......api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02....................+.QX............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-timezone-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17872
                                                                                                                            Entropy (8bit):7.184613087827584
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mBsjWfhWn+Y3DGk8ZpH3GCJEFx/S6tj4+Y3DGEQC8JN77hhImH:+qDGkiRBE7S9DGZ3hSmH
                                                                                                                            MD5:2A65C935C09DE2E87436C76F4EF9F70F
                                                                                                                            SHA1:9836BFB596A84C9CF9A34759B2D3851262A6BCB1
                                                                                                                            SHA-256:3D11A4F5CBFCE8288D67385FF415B13768B89A9D3FC9B6047A0B525E8DC4185F
                                                                                                                            SHA-512:8C7094F4111C47E6BE7E2903F1EC519B9C393439F6DF9CF9D629E07F32545CF76A52AE11D1F23E008E7BD7265B7D3E2A24F237E8B89A9681562A3F31473C3FD8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L......E...........!......................... ...............................0.......=....@.............................E............ ...................9..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@.......E........<...T...T..........E........d..................E....................RSDS.:'.n..B...Ot......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02.......................E....................(...\...........*...f...........C...............9.......................H...........%...j...............b.....................................api-ms-win-core-timezone-l1-1-0.dll.EnumDynamicTimeZoneInforma

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-crt-conio-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18384
                                                                                                                            Entropy (8bit):7.1391272647934425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mhIWfhWv+Y3DGk8ZpH3GCJEFxhZzV+Y3DGEbt8JN77hh233+:0+DGkiRBEr3DGUK3hY3O
                                                                                                                            MD5:D3B28EC94FAB13AA7150B3AC1ABFB24B
                                                                                                                            SHA1:62CE8413919282D9E4B2E3FF51B61F9FF14C8D34
                                                                                                                            SHA-256:598F0CD35118BA86DC7CD4A5240ABEEE6D01D27A0960AE49766C84C2111662BA
                                                                                                                            SHA-512:75C6754D5D1EB3F2793D1E252C90085045009DE5FFA5E6E48202D12828024ACE8D3D450E0E411F8447A51A3C19BF565D9527917BDA45D76AE73B5965FC3FA6BB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L....n............!......................... ...............................0......}&....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................n.........8...d...d........n.........d................n.....................RSDSC..T~.~.:GmfY.......api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........n.....T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-crt-environment-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17872
                                                                                                                            Entropy (8bit):7.124968259908221
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mGWfhWX+Y3DGk8ZpH3GCJEFxeM+Y3DGEA/8JN77hhX+/:0WDGkiRBEbDGu3h9g
                                                                                                                            MD5:7EC18A5100D4C149F5CECCD5D28ABAB4
                                                                                                                            SHA1:CA9A57E017DF2E6019AE5BC79144764E752699F5
                                                                                                                            SHA-256:0F91011F52DC33ED32144E67EE5B3A977ABACA32F6A76AE522450CBFD33C1F1D
                                                                                                                            SHA-512:E63CDE78447A896A25DD758A54A6C2311311C66DBB5ABBF658F357F6546FEFBCD0B1120394D47EA2E1F4618A848D8AB8E5F41BFDA6A331EB9D4220E4BA9FE3C9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L....<i*...........!......................... ...............................0......|.....@............................."............ ...................9..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................<i*........>...d...d........<i*........d................<i*....................RSDS.[.lv.C.8...u.......api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................<i*....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\concrt140.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):248272
                                                                                                                            Entropy (8bit):6.687188620681205
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6144:R2y3hhQZpA2C/VFuGEcL6hmDCYfM1+/e7VR8AocazlBQdSkIuVxRYy12z/VszBR/:Ht+zsM1+WkzRuVxRYPzS/n
                                                                                                                            MD5:BC440B80B432081023D3F7043F1C0C97
                                                                                                                            SHA1:8EB0CF8C6A611F372486083E85C0873E2A9C6B4D
                                                                                                                            SHA-256:8C9AB74CE98F323B557FCFF323D13144F97B1E021E0EF28A5E8FB383860FE871
                                                                                                                            SHA-512:BE88DC81B2663EEAF9AF7B5ED6744411C4D7943F91B75EDAEDE9F7EF8D1C7B91BE3DC5D6F460C2E3FD26281D0D11D6477E88C9D4A5D570BA49474A51F0E6EB29
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........HD...D...D..../..F...M.~.N.......A...D..........O.......C...............E.......E.......E...RichD...........PE..L....h.].........."!.........x...............0............................................@A.............................K..<r...........................9.......+...;..8............................<..@............p..8............................text............................... ..`.data....4...0...2..................@....idata.......p.......N..............@..@.rsrc................`..............@..@.reloc...+.......,...d..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Config\Base.ini

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):33
                                                                                                                            Entropy (8bit):3.8330556814482386
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:a/uVMWJQKrWy:aMMErWy
                                                                                                                            MD5:369E92A1F7A7ECEDCACA7D7845CC3F74
                                                                                                                            SHA1:C001EF0B380BB783ADBEA52EF1D9061882122499
                                                                                                                            SHA-256:226E2ED6957CF8D5D7BE843556425A4E3DA5C33D54407D2187F8105AAEFC92D9
                                                                                                                            SHA-512:8A06CA6B6CB92E5F79B4095B20F943A0A61F8049F4F4D7D3B45B5E09E5F9E9D2335BAAAAB3501A63037EA8FC58A80C7A51E24608BBEB2CA469E31E95E9928CB9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:; Base.ini is required to exist..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Config\BaseDeviceProfiles.ini

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:Generic INItialization configuration [DeviceProfiles]
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):34761
                                                                                                                            Entropy (8bit):5.473320491342328
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:dkfI+LHANt2rulkjOFOQgNtvjOaO63vYcDbEyBoOWe0mp+Pwh0XeTfasQ/mzU+lv:dkZiBqbn
                                                                                                                            MD5:10AE9CFE530FB68319DAA15BA1C3A8FC
                                                                                                                            SHA1:6A725189BF8DF1288C4DF0FD188ED3410DED2728
                                                                                                                            SHA-256:FFE32A801774EA1DB3649E24534458C00065037277F013C04ADD50ED19F6F00D
                                                                                                                            SHA-512:6428827CF4EA92E604628E81B20D0BBDE90125FF5A008AAC1D700E8918CCC1E501613FDC22EA700AB4A45D734D53483BE50BC04B15AAC44F7C55375C09A2E9A4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:; Add a ArrayOfStruct key for all DeviceProfile PerObjectConfig sections (this must come before any DeviceProfile sections)..; Note that * properties don't get written back out by the config system, but these aren't real sections, so that should be okay..[DeviceProfile]..*TextureLODGroups=Group....[DeviceProfiles]..+DeviceProfileNameAndTypes=Windows,Windows..+DeviceProfileNameAndTypes=WindowsNoEditor,Windows..+DeviceProfileNameAndTypes=WindowsServer,Windows..+DeviceProfileNameAndTypes=WindowsClient,Windows..+DeviceProfileNameAndTypes=IOS,IOS..+DeviceProfileNameAndTypes=iPadAir,IOS..+DeviceProfileNameAndTypes=iPadAir2,IOS..+DeviceProfileNameAndTypes=iPadAir3,IOS..+DeviceProfileNameAndTypes=iPadAir4,IOS..+DeviceProfileNameAndTypes=iPadMini2,IOS..+DeviceProfileNameAndTypes=iPadMini3,IOS..+DeviceProfileNameAndTypes=iPadMini4,IOS..+DeviceProfileNameAndTypes=iPadMini5,IOS..+DeviceProfileNameAndTypes=iPodTouch6,IOS..+DeviceProfileNameAndTypes=iPodTouch7,IOS..+DeviceProfileNameAndTypes=iPhone5

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Config\BaseEngine.ini

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:Generic INItialization configuration [InstallBundleManager]
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):157512
                                                                                                                            Entropy (8bit):5.327507630883185
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:+SBCkfn5OkZX53ftqSiyh1olLWI5qs7ieWy1xAeU5GCg3Dnz1Y0nXpSrVWpXFVsZ:+AD1olLd7xUZENxg2Vg
                                                                                                                            MD5:1F924BCE5B3D2653CA87F6241EA65BA9
                                                                                                                            SHA1:1D102BAAE15BAC7F6E3F73D40AFC4B2BDA4E187D
                                                                                                                            SHA-256:BE94115FC5E64EC51A387958A2C87EB49A872CA52C53F308AEFE0E0E15C35912
                                                                                                                            SHA-512:F77981A58F1991589E13AA2E34CDD752E5870826D4AF9356C070199E1DAFC1A662BE3C6F28A154F761A3E61196B474C194C9F5824F21613212DACC71CC0568EB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:; This file defines the default settings for core and engine-level features..; These settings are overridden by a project's DefaultEngine.ini file and per-platform overrides..; Some of these settings can be modified from the project settings in the editor....[/Script/EngineSettings.GameMapsSettings]..GameInstanceClass=/Script/Engine.GameInstance..EditorStartupMap=/Engine/Maps/Templates/Template_Default..GameDefaultMap=/Engine/Maps/Entry..ServerDefaultMap=/Engine/Maps/Entry..GlobalDefaultGameMode="/Script/Engine.GameModeBase"..; Example for map prefix and game mode name setting..; +GameModeMapPrefixes=(Name="DM-",GameMode="/Script/GamePackage.DMGameMode")..; +GameModeClassAliases=(Name="DM",GameMode="/Script/GamePackage.DMGameMode")..LocalMapOptions=....[InstallBundleManager]..ModuleName=NullInstallBundleManager..EditorModuleName=NullInstallBundleManager....[URL]..Protocol=unreal..Name=Player..SaveExt=usa..Port=7777....[HTTP]..HttpTimeout=180..HttpConnectionTimeout=60..HttpReceiveTimeou

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Config\BaseGameUserSettings.ini

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):61
                                                                                                                            Entropy (8bit):4.482561986290143
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:HRAbEqKdwDQJBApKGExdQIAcGsPRCv:HRY8GIBA8k9cQv
                                                                                                                            MD5:1DB30560254DC359FF91940E10DDB1A6
                                                                                                                            SHA1:6B9F33E0F1B5E827028FC838C233259F2E389485
                                                                                                                            SHA-256:CD92B03B5A94EAD554160461A3FAA9E8E1FDF52F37A23C000EBE1164FC28F90B
                                                                                                                            SHA-512:2BAF7B85A29F23460DAE30E128FF42D46D91EBDFFA36EE62D5D5DBFDF178729E4DCE5BA9B9A30A1DEB6365D36971F446F5084A40F307F49842B85626397131DC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:[Internationalization]..ShouldUseLocalizedNumericInput=True..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Config\BaseLightmass.ini

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):11059
                                                                                                                            Entropy (8bit):5.103147782440043
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:Y2PCbAZIxNj0IrmQp4JV3ugs19RcaJRkQPMgaNOzvHoNs/OgkySxsm:DKieEo0V+2aJRkQsOmsLkym
                                                                                                                            MD5:382321EAD709D931C39737A8ADC01183
                                                                                                                            SHA1:9F745A520F81939659D77FEB339144FE23ADD81B
                                                                                                                            SHA-256:26B2D78F9D499F75D4274332DCCDFACCAAABB7C9FD1F63DAFC75315320438268
                                                                                                                            SHA-512:DDDCE196B1DD7A66316855B945CB3ED98286A3735B716CA0A9E1E7A42B8ED75E2AA1390690938F79EBABDD54440FFBDEAF8E0F2B52BA5758EB072CF80271E101
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:; These are tweaked defaults for various lightmass solver and export settings..; Artist oriented lightmass settings are in the editor UI..; Documentation for all of these is in UnrealLightmass / Public / SceneExport.h..; This ini is reloaded every time a lighting build begins, no need to restart....; Warning: overwriting this file with an old version will cause the editor to crash. This file must be in sync with the editor executable...; Instead, create a DefaultLightmass.ini in your project and override just the values you need, then the overrides will continue to work on version upgrades...; https://docs.unrealengine.com/latest/INT/Programming/Basics/ConfigurationFiles/..;..; For example, in your project's Config/DefaultLightmass.ini:..; [DevOptions.PrecomputedDynamicObjectLighting]..; SurfaceLightSampleSpacing=400....[DevOptions.StaticLighting]..bAllowMultiThreadedStaticLighting=True..ViewSingleBounceNumber=-1..bUseBilinearFilterLightmaps=True..bCompressLightmaps=True..bUseConserva

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Config\BasePakFileRules.ini

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:Generic INItialization configuration [ExcludeContentForMobile]
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1310
                                                                                                                            Entropy (8bit):4.8887259246146755
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:QSMx71rUoSBpMyQDQ0RzMga3oAD7FQR0YehvNb:QSMxx2NUzx5uZ4Yv9
                                                                                                                            MD5:18DA090A41DFBF5B6DCF765DDA7455ED
                                                                                                                            SHA1:AC27AD231720FC899AC2F5D1B48C52DD4D48F606
                                                                                                                            SHA-256:E1901D684774984A794368E33B1229AF3A834506AE4D10C4C45CC2AAD0A5AA83
                                                                                                                            SHA-512:2BCE9838DFD0178470D588F93C599283921061CFF4FA8DFF4F40B9FD5CB0D9DF7B80954654F0A8490B6F6B6A60645AB02DE8D4A8D70FA0C0A7C183B058047B5F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:; These rules are applied in order, the first rule that applies per file is taken and no others are evaluated..; [SectionName]..; bOverrideChunkManifest=false ..; If true this allows overriding assignments from the cooker..; bExcludeFromPaks=false ...; If true this removes entirely, cannot coexist with overridepaks..; OverridePaks="pakchunk1" ...; If set this will override pak list, comma separated..; Platforms="iOS,Android"...; If set this rule will only apply to these platforms..; Targets="Shipping,Test"...; If set this rule will only apply to these configurations..; bOnlyChunkedBuilds=true...; If set this rule will only apply to chunked builds..; bOnlyNonChunkedBuilds=true..; If set this rule will only apply to non-chunked builds..; +Files=".../*FileMask*.*"...; List of file masks to apply to, using the C# FileFilter class......[ExcludeContentForMobile]..; Exclude specific large textures on mobile platforms, this was moved from CopyBuildToStagingDirectory.cs..; This can be added to

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Config\Windows\WindowsGame.ini

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):89
                                                                                                                            Entropy (8bit):4.742925459228287
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:w241AVHGSW1tKAKM6yQjUAKM6zntM:wdymQAK14AKB+
                                                                                                                            MD5:A3879611FF83D94C1352E06EF35CFD85
                                                                                                                            SHA1:F9598AEF32DAA75929A8300C02FEB308E89EFD1E
                                                                                                                            SHA-256:B2064E1945F399CDCF2AF1F1AFD83397AF3C30AC14ED955F21DDA7FC9620296E
                                                                                                                            SHA-512:1A52D5BDCF5ECD6D5086E8E0272DAD86E1E1AF92154C4ADD098E1CC12B71F995E91F7A37D57F03C20717D0DD7939041DF9E31C662626597494CDF2B75A0000E3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:[Staging]..+RemapDirectories=(From="Engine/Plugins/Lumin", To="Engine/Plugins/MagicLeap")

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ar_001.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXEl0t6E7lFEKe:SvKM0t6gCKe
                                                                                                                            MD5:CF788FA9793FEA6104E904FBA48B9ADE
                                                                                                                            SHA1:5105A53F269A6C445FE58F0AB7BB501BF5790960
                                                                                                                            SHA-256:D49D36962528CD70E638FE62C2A675838D5F6D13C229F6A107530D58C458D100
                                                                                                                            SHA-512:B07CED3B04E2CE33B0FA215AE03002E666D5408F31ADE8FE84F46E2A7474D277B40887F090D5DB6ABEA58B6A8DF385F952DD614979AD903AAF31B524A06AA93B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ar_DJ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):92
                                                                                                                            Entropy (8bit):3.28350515130155
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tluFblElwql5ERoZPUl1RY:Sv6BMw7CZMu
                                                                                                                            MD5:18933A825F0FC4CCD2CDEB68524F851F
                                                                                                                            SHA1:640CFC46024F16F989198B416141DACAC18CC955
                                                                                                                            SHA-256:F73099366D30DD36F3DE23E28F7851B57454090B3AF7648B1125E343F1321B92
                                                                                                                            SHA-512:1DDCB869360D19B469FA9DB3147925DED100A931F47CE4FEA7B6384F0A3AF6500FD8D8A8A0672D8B5CF6A47EEA0D874C4445C1DAD9AB16B72C14BC7F7FF39973
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...................................t.u.....o......P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ar_EG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):144
                                                                                                                            Entropy (8bit):3.8427825837613345
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tltv5/jlullJJstP93OkwlyHbtHUnZWf0lF0/xKlF1hFn:SvMl5Mxwly7K0f00g5
                                                                                                                            MD5:AE6774AD1B4E487D0992D22700F9087F
                                                                                                                            SHA1:46B5C49C76A7106F33BFA9BB13EC5B0F50EFF50B
                                                                                                                            SHA-256:DC359B3A630DAB0A5B4E728806547747FC25105B70ABD3B22E8BFF20A3995EF5
                                                                                                                            SHA-512:095B725D6F78B78A8F77DFA461B716A480219A969EFC8246045BC0B93A18BA1377BC17BF4FF99B390038DB71DB3A387C4B6C658F858B735A897D41CE6C34CE79
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...................................................NN.........P.......P..o.t...... u..`... ....o...... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ar_KW.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):144
                                                                                                                            Entropy (8bit):3.8427825837613345
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tltv5/jlullJJstP93OkwlyHbtHUnZWf0lF0/xKlF1hFn:SvMl5Mxwly7K0f00g5
                                                                                                                            MD5:AE6774AD1B4E487D0992D22700F9087F
                                                                                                                            SHA1:46B5C49C76A7106F33BFA9BB13EC5B0F50EFF50B
                                                                                                                            SHA-256:DC359B3A630DAB0A5B4E728806547747FC25105B70ABD3B22E8BFF20A3995EF5
                                                                                                                            SHA-512:095B725D6F78B78A8F77DFA461B716A480219A969EFC8246045BC0B93A18BA1377BC17BF4FF99B390038DB71DB3A387C4B6C658F858B735A897D41CE6C34CE79
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...................................................NN.........P.......P..o.t...... u..`... ....o...... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ar_MA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):572
                                                                                                                            Entropy (8bit):5.373790886124089
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:Q74tjYwqxDGPbo9iVu92VnVu92VpEIEQPwG:Q7Ur+IEEw92tw92nDV
                                                                                                                            MD5:F47AB3C1C4A8BB34305293AE3725CEC4
                                                                                                                            SHA1:73718A4B40FB655D24AB4A55EA8FD037A0201B8B
                                                                                                                            SHA-256:325158DB8005C2BBAA3D9AD4AFE7DC196EB27B6072AC94BFD59B7351DE23362F
                                                                                                                            SHA-512:987C454DFCD870441918591C0929A075F55BDD5B58A803E8BDE320F0D596F1D90AE02A312E9FC8FF9F6FC1A52E1C925B72A1A76AF979ED20E1A4CA1995077DE1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................b........:...:.4.*...#.(.1.J.D.../.,.F.(.1...4.*.F.(.1...F.H.F.(.1...J.H.D.J.H.2...[.. . . . .~. ... ... ... ... ... ... .o. ... ... ... ... ... .c. ...]...................NN....k..)...45^W*....................V.....................\D....%...'..................V.........................V.....................\D....%...'..................V........................K..P....P..P..o.t...b.. R..`d.. ........c...p...}...............................k.. p.. ....H...U...u.. ..`.y.. ....[...o.w....`...`f.. ...`}..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ar_SY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):376
                                                                                                                            Entropy (8bit):4.934418116358701
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvWEVwly7579tIn/MqMYofGtIn/xtIn/MqMYofGtInLfZMgetlfzMR+nU1cf:polxtOOVGtOxtOOVGtaMxNPU1c
                                                                                                                            MD5:825C655E66A8706E0A6186265B79182C
                                                                                                                            SHA1:7F5332DA7D0E212F62A51896E84C01B137558BF9
                                                                                                                            SHA-256:87C751A030504B6C93FF63960B3502705F6125C9A687DE7786EB6C36BA982B9F
                                                                                                                            SHA-512:D33B86814453E512DCE2ED5618F7B30C98F1AF4F560BAFE593E6ACAF5040F43F42C62C20884D819364167793DA67A2B8D521BA0895FEC877E54F78C01EE767D8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................Q.. ........V...V...........6..........................NN..^D........<.Q......6QD.6......3.'.%.....3.%.........^D........<.Q......6QD.6..^D........<.Q......6QD.6......3.'.%.....3.%.........^D........<.Q......6QD.6.........P.......P..o.t...6.. u..`8.. ................%...........2...?...L...........?.. D.. ..H.I.. ..`.M.. ....o.w.:.. ...`O..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ar_TD.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):92
                                                                                                                            Entropy (8bit):3.28350515130155
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tluFblElwql5ERoZPUl1RY:Sv6BMw7CZMu
                                                                                                                            MD5:18933A825F0FC4CCD2CDEB68524F851F
                                                                                                                            SHA1:640CFC46024F16F989198B416141DACAC18CC955
                                                                                                                            SHA-256:F73099366D30DD36F3DE23E28F7851B57454090B3AF7648B1125E343F1321B92
                                                                                                                            SHA-512:1DDCB869360D19B469FA9DB3147925DED100A931F47CE4FEA7B6384F0A3AF6500FD8D8A8A0672D8B5CF6A47EEA0D874C4445C1DAD9AB16B72C14BC7F7FF39973
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...................................t.u.....o......P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\as_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXEl0t6E7lFEKe:SvKM0t6gCKe
                                                                                                                            MD5:CF788FA9793FEA6104E904FBA48B9ADE
                                                                                                                            SHA1:5105A53F269A6C445FE58F0AB7BB501BF5790960
                                                                                                                            SHA-256:D49D36962528CD70E638FE62C2A675838D5F6D13C229F6A107530D58C458D100
                                                                                                                            SHA-512:B07CED3B04E2CE33B0FA215AE03002E666D5408F31ADE8FE84F46E2A7474D277B40887F090D5DB6ABEA58B6A8DF385F952DD614979AD903AAF31B524A06AA93B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\asa_TZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ast.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):28432
                                                                                                                            Entropy (8bit):5.567467981150978
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:AJG1Pi0609voRI21kVcQ4PID8rPfAxD/QVzFkVRe0Xqwge:AMtVkVPfAxD/QVJM5Xq6
                                                                                                                            MD5:CC5E90EE9B5824AA5466F1D6AC53342F
                                                                                                                            SHA1:EAB29097DF96421D3262C9820B6F0D0F9D121214
                                                                                                                            SHA-256:1B487B2128F64C7B5F6B4C7526F043BADFFB9F86D1C2055F935C8CFA021C831B
                                                                                                                            SHA-512:2AD0697D4DA6CF68BFF98DCB3D6887B7C9253A7FEA1025422FFD61DA74155E17508859A1F214B4D51691C975D6629F6DC62A0EAE96156790A842F9C350A264FC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................V.......g........X...1.T...2.T...3.T...4.T...s.....7.b...N.D...a.E...g...e...h.a.m...h.e.d...m.e.g...m.i.....n.e.h...p.a.g...s...b...t.a.h...t.e.k...v.i.e...x.u.e...y.e.k...E.D.C...A.v.i...G...e...J.M.M...K.a.M...K.M.M...O.c.h...P.a.y...X.i.n...X.n.t...X.u.n...a.v.i...c.b.l...c.b.r...c.o.n...c.u.l...g.a.l...g.c.h...m.o.n...o.c.h...p.a.y...p.e.r...r.a.t...t.i.g...x.i.n...x.n.t...x.u.n...L.e.i...L.h.o...L.w.a...m.o.n.u...r.a.t.u...g...e.i...E.i.e.n...E.i.h.M...s.e.l.....t.r.i.....{.0.}.b...7.b.i.s...A.n.n.a...E.i.j.i...E.i.s.o...E.n.g.i...E.n.p.M...E.n.. M...G.e.n.M...H.M.a.n...H.M.e.i...H.M.e.n...H.M.j.i...H.M.k.i...J.i.a.n...J.u.e.i...J.M.e.i...J.M.w.a...K.a.e.i...K.a.h.M...K.a.j.M...K.e.i.M...K.M.a.n...K.M.h.M...K.M.j.i...K.M.k.a...K.M.w.a...M.e.i.M...M.o.n.u...R...X.....R.a.t.u...S.h.M.M...W.a.d.M...Y.M.r.M...Y.M.w.a...e...C.....h.o.m.e...L.c.h.M...L.n.i.n...g.a.l.l.u...c.a.b.r.a...g.o.c.h.u...p.e.r.r.u...t.i.g.r.e...J.M.g.a.n...J.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\az_AZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.870450165586334
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/6kftl7+t3:SBtkJYlU8g8l/Nl4t
                                                                                                                            MD5:BB0AEDB2268541C63B88E2DAA6A83F14
                                                                                                                            SHA1:E7BB3AA9133FB59F22DDA92CEBC150BB83A74C1E
                                                                                                                            SHA-256:6B40AF34079AC564CCBCFA52F909A460198F52938E5D09BB0A6D60EFBD64E68F
                                                                                                                            SHA-512:25A48EF5A44915D747660225B049D6D2003E460135076302D8C6541ABAE568A21F2B2F28EBBFA9BABFC630CFFA78BDA769B8196FE63110F533C7DC9107AEBC7F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.................................a.z._.L.a.t.n._.A.Z...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\az_Cyrl_AZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\bas_CM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\bm_ML.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\bn_BD.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXEl0t6E7lFEKe:SvKM0t6gCKe
                                                                                                                            MD5:CF788FA9793FEA6104E904FBA48B9ADE
                                                                                                                            SHA1:5105A53F269A6C445FE58F0AB7BB501BF5790960
                                                                                                                            SHA-256:D49D36962528CD70E638FE62C2A675838D5F6D13C229F6A107530D58C458D100
                                                                                                                            SHA-512:B07CED3B04E2CE33B0FA215AE03002E666D5408F31ADE8FE84F46E2A7474D277B40887F090D5DB6ABEA58B6A8DF385F952DD614979AD903AAF31B524A06AA93B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\char.brk

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):23072
                                                                                                                            Entropy (8bit):3.393029492569487
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:ccccccccccccccccccccccccccccccccccccccccccccccccccv5ZZbybXb2blbO:r5ZZeLKJ5WpN/XjZ
                                                                                                                            MD5:7F715831FE66A75F1EFF0D3A51085621
                                                                                                                            SHA1:73D7321F9D49F27D9D38A53D113B066B609B1586
                                                                                                                            SHA-256:0D5069285BD16B99D459455BB3E3950880B5CAD7CBDF865719171041912F7B5B
                                                                                                                            SHA-512:F57D9522AF6E9AB8CC89EC396E7756ED812236FCDB76C37E4E02FBE8B23309B89C006D125435933D46CD1568C7704B2A2F49A9EAEB9BDE482AD1A91764A90CEB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:...'........Brk ........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ..........Y......P...x................L..XQ..2...PQ..................................,.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,...........................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\de.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3024
                                                                                                                            Entropy (8bit):3.840448449572339
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:/EL27l0wx4F1Nd7KX4Qc039gZb04VU253PePtJBLPqilg8zM/Xt15IlDB1Zy:/ELH6O1GcbZd9ktPfIXt0Be
                                                                                                                            MD5:AC1477035AFEA949843AB8E8F101517E
                                                                                                                            SHA1:E195EA2719ACF9133653F4F691DCDA32414E6236
                                                                                                                            SHA-256:2761825769003AF3030EC77234C60C2C59631D5ECC5680C7F46748C7EFE09790
                                                                                                                            SHA-512:D5954A36E53D2995B51EEBD04D67C342D90BDDB1EEBB31094CAD59B99233EB15560E10C4969E521927AC5FE035C2D2C70520CA8E88AA6B423DE6E98FE170EE49
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................Version.exceptions.SentenceBreak......C.....F.....G.....I.....L.....P.....Y.....Q.u.....C.a.....C.o.....D.i.....D.o.....D.r.....F.a.....F.n.....F.r.....H.r.....J.r.....K.l.....M.i.....M.o.....N.r.....O.p.....R.d.....S.a.....S.o.....S.t.....W.g.....e.v.....F.a.m.....M.o.d.....P.I.N.....S.t.R.....Z.t.r.....a...D.....a...M.....f.r.z.....i...J.....m...W.....o...A.....u...U.....v...T.....z...B.....z...Z.....A...M.....A.b.s.....A.b.t.....A.b.w.....A.d.j.....A.k.t.....A.l.t.....A.p.p.....A.p.r.....A.r.t.....A.u.g.....B.e.d.....B.e.n.....B.e.r.....D.a.t.....D.e.z.....D.i.m.....D.i.r.....E.r.f.....F...f.....F.e.b.....F.r.l.....G.e.m.....G.e.s.....G.g.f.....H.b.f.....H.r.n.....I.n.c.....I.n.h.....I.n.t.....J...D.....J.a.n.....K.a.p.....K.o.p.....L.t.d.....M.a.x.....M.i.n.....M.i.o.....M.r.d.....M.s.p.....N.o.v.....O.b.j.....O.k.t.....P...M.....P.f.d.....R.e.g.....R.e.l.....R.e.p.....S.e.k.....S.e.p.....S.t.d.....S.t.r.....T.e.l.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\en_US.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.7234597887964593
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlu12Ol/8klclsX+RZlUlnBlk:SBtkJK2Ol/8sU2cwlBlk
                                                                                                                            MD5:74852472ABC6DD63B12C4766472C9B74
                                                                                                                            SHA1:5B59504CCCC2A557A39AB15BFFAC0270D4E4014A
                                                                                                                            SHA-256:BD31F37629AFE5B5CA7801F26F251980F6F6A737C01C3C5BE19E10B8F4840F00
                                                                                                                            SHA-512:80E3F257A80030BECD995377E912BCB62940C2819CEE559441CD3B9A141229A7E071FA75B91B4B868DCDBFD00AC389F5250C7D49D0F8096E8CDF9B045523D0DB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................Version...2...1...1.9...1.4..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\it.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):712
                                                                                                                            Entropy (8bit):3.369956447252417
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:WjthcQRSMC7iqha4uA6Fyp1yl12TeRTVIKolACK4JgJ9LrkSlj:WjwOC7/hshQyMz7K4JK9L4Slj
                                                                                                                            MD5:1ADFA9703C0CBA543C2A6A14195B80F9
                                                                                                                            SHA1:3286BAEB9407AEA5FD5DB4BAF1523F2CB78BC686
                                                                                                                            SHA-256:001162812BCBC4B3E2F8747BFACC6BBFB6084DD04FC37DADF1BABEC54B5E0144
                                                                                                                            SHA-512:3989E555C9F058B942542C28200AC5419C84DAF14DC6A321C5B6C2D3DD4233ED7475663398C6CF868F22DCF8A21AF80A4BCBD7718C31843747F8DBEF6729CF5B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................Version.exceptions.SentenceBreak......D.....L.....D.C.....d.r.....o.n.....r.a.g.....C...P.....C.f.r.....I.n.g.....L.i.v.....L.t.d.....M.o.d.....N...B.....S.i.g.....U...S.....a...C.....a.l.l.....a.v.v.....d...C.....d.i.v.....f.i.g.....i.n.t.....p...i.....p.a.g.....s.e.z.....t.a.b.....t.a.v.....v.e.r.....v.o.l.....G.e.o.m.....a.r.c.h.....d.o.t.t.....m.i.t.t.....c...c...p.....N...d...A.....N...d...E.....N...d...T.....O...d...G.....S...A...R.....S...p...A.....U...S...A.....d...p...R.....2...1...1.9...1.4...S...M...A...R...T.....-.6.Y.E.^.......................T.....;.1.m...|.......".c.........@...h.w.,.'.....r.O...J.......3....... .(......`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\line.brk

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):53856
                                                                                                                            Entropy (8bit):3.7418320755024443
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:2DoEL0eu4444443P444444444444444F44544444444444b444c44Q4e4444444+:2cELN/d4VqcVk
                                                                                                                            MD5:3134881D21CCA929C6DA5ED7C81B27C6
                                                                                                                            SHA1:8C4DF4847AC71183503E521154A91B3F849CC834
                                                                                                                            SHA-256:D5F7E98EAAA8F0EBE30056C6864DF8E01B00F1BD421F9D02888A40509C9B943D
                                                                                                                            SHA-512:D6AD8C3748A9CA8FCD289532EBE1D4B7BFF1619E6713330855935BB3F62B10B7D95156A85029CBBA773A898E6EB92FC61978BFD11BAF2AB7029C6527D28E7C49
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:...'........Brk ........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .............)...P....@...A..x....H...f..(...."......................................Z................................................................................................................................................................................... .....!.".............................................#.........................................................................................#.......................$...................................................................................................................................................................................................................................................%...........................................................................................#.......................&...............................................'...............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\line_loose_cj.brk

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):56472
                                                                                                                            Entropy (8bit):3.7017475681634124
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:hrVu4444443P444444444444444F44544444444444b444c44Q4e44444444444D:TopB4FWnVL
                                                                                                                            MD5:506FF44FA1B804128F6A9C5C352FDAE0
                                                                                                                            SHA1:7DEBF66ECE7B93EC08CBE59A37B2F5E6892F84FE
                                                                                                                            SHA-256:643605B61FBCA9B13DF2CB2CF583EC7F4490E95E712A8168EBFB20520B6065D1
                                                                                                                            SHA-512:A2F170F972B630AC47C7B769AB43F3E0E5A9FE4D95FA060BD07A46A0543A683D450893325C24BFC9BFA5922E88463157A57B1B7656661600314126093E271A97
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:...'........Brk ........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .............-...P....F..8G..@...xP..`e......&.....................................b......................................................................................................................................................................................................... .!............................................."................................................................................................."...........................#.......................................................................................................................................................................................................................................................................$..................................................................................................."...........................%...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\line_normal.brk

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):53552
                                                                                                                            Entropy (8bit):3.732355638311328
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:ADoEL0wu4444443P444444444444444F44544444444444b444c44Q4e44444443:AcELvopd4VtEVf
                                                                                                                            MD5:C9368F051BFFC010B8984B489BF06E6C
                                                                                                                            SHA1:6864FB95D254CFCAAAD526FE8E84A15DB08ECA5A
                                                                                                                            SHA-256:B29C4358C5D605DC14BE6B1C16FD6BB022582051502952BF91C3CE087371C63D
                                                                                                                            SHA-512:2AD8D40A519B1FA375192C2AAF6AB23A73DA3FD4498E1C05463101B4C735A65F8EAAAE65C2B92408A962A937F2E0B1490E234101A816047ED9EEE694BCC24720
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:...'........Brk ........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .............)...P....@...A..x....H..`e.......".....................................Z................................................................................................................................................................................... .....!.".............................................#.........................................................................................#.......................$...................................................................................................................................................................................................................................................%...........................................................................................#.......................&...............................................'...............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\root.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):660
                                                                                                                            Entropy (8bit):3.969364612406447
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:WR55CTYlb/PnIXJ3EVReO82PADFE+Yc/ALXN0ZYEI4tiPd2oJofQlnO:W5Ckb3I52sDNoLXN0ZLtO2oyfB
                                                                                                                            MD5:0BE7629F239F7A16B71FDB4AC8BA1A18
                                                                                                                            SHA1:DF18DBC09EE192D46D05CA4989156AC598FC12D7
                                                                                                                            SHA-256:7651D933A0D58C98A6DAFAB3C0F093D713A352B03938339F62AC6C185DAD4B0A
                                                                                                                            SHA-512:CFA279D3D09069DCEF43C6A549B4A302E8675670283287AB98B34A332AFC199764888A6C777DA60CFCE942A6F59C3F66987F491C0A48317DBD5CB1217B82691A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................Version.boundaries.%%DEPENDENCY.grapheme.line.line_loose.line_normal.line_strict.sentence.title.word.dictionaries.Hani.Hira.Kana.Khmr.Laoo.Mymr.Thai......l.i.n.e...b.r.k...c.h.a.r...b.r.k...s.e.n.t...b.r.k...w.o.r.d...b.r.k...t.i.t.l.e...b.r.k...2...1...4.9...3.2...c.j.d.i.c.t...d.i.c.t...l.a.o.d.i.c.t...d.i.c.t...t.h.a.i.d.i.c.t...d.i.c.t...k.h.m.e.r.d.i.c.t...d.i.c.t...l.i.n.e._.l.o.o.s.e...b.r.k...l.i.n.e._.n.o.r.m.a.l...b.r.k...b.u.r.m.e.s.e.d.i.c.t...d.i.c.t.........o.~.....%...9.9.9.`.E...R...@.I.N.Y.e.q.z.......o.~.....%...................9.9.9.`.E...R.....3. .(........./..`...P...P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\sent_el.brk

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):37144
                                                                                                                            Entropy (8bit):3.478348288934909
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:TtUga3kFDIayEm7PCbbV6GTu0b83+QIkHz8kX4LWhifIrUL/XQM8ZFeyiFHaf/0l:yga3Uwx7PCvE8b83aVfU4gJsZF6
                                                                                                                            MD5:8E6CD9C6706FA2C50250CABE26EB2F23
                                                                                                                            SHA1:89CBB53A6A8EE2B46FFEC8F114D5BC53733A45E9
                                                                                                                            SHA-256:3CC9C8EDC37CDC75F7D60C3CF12655A6A4E85B46BD5632BB1ABA62A331544ABA
                                                                                                                            SHA-512:80A3029ADCE05D245C58F4A936C05525B4E97A74C5389018D7F8F20F7A2AB84CEC0C7FAC172E1D997E9FAA7A6B3B045A8DD430613EF6EB6DD4C955FDE1544579
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:...'........Brk ........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .................P.......0...`.......p.......p.......................................*...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................*...................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\thaidict.dict

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):126135
                                                                                                                            Entropy (8bit):6.142617744421991
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:7a9SJftL8y84s1MfBzpNVMHmb5xOXwJPUPB6A+/b82QeH:u9SJHTRpNVzOce6Z82VH
                                                                                                                            MD5:A4C60A54A726B33F3ED8E7D9448F1AD4
                                                                                                                            SHA1:01D66EEC919AF2DB8A4C75E5CFDD9233C4C19768
                                                                                                                            SHA-256:04A9C7F7AB10F7F2123A3782CCB300310EA3A601DBAC09A8173D540E01C2E949
                                                                                                                            SHA-512:44CF652C41EE9FC9D8F20C087DEEE2899A04269933A4BC810AC70EA120564238ECC90198EA99055863C595F7232A5DCE0A80C00696A9A0788DFEEE22F5C4C4B1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:...'........Dict........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html . ...'...'...'....................-..(.(.../.kKB.B.|C...D.....#..*..*.~+..-....@_@,BDD..!.....-#L*.5.!..(.8%!.#!4@.-#L!.#..f.r!..@... ..<@..-#L--.D..L!.1%D..L!.2#L.-.!.4.D..L!..f...".2.....D.%.L! .".#..'.+.n.I .-.-..@*D..H!..7-.!...4(.6.!.#-.!.1..4.H.! .(..2...@.'.! ..<*.8....'.##.!.2A..! .%.%4'.Z.+DH!I! .....H ..'5.!.%3!..!..!.<!F#.....1...H!.%2#I2! ...!.I! ."})1)..-(B2I!.-..!*!..D.J-....\'..@..5".!.B..!.@.#*!"N#\'.(..4'..9.#"L!.#5!!.#..@.#(!.-.G2.=U4.=BL.A%..L .@...C..I!.-#5B.*.L!........@..H.!.L*D.@.5"!!.5@-G!!..4.. !..2B.!#:%\'..(.%!'.0! ...n"..@(H!I!..4%!.%<A#A.D.qH,I!.%.! ...3.....@.%5.".}H."!%..-..@.....(%."!.##4!.....!.O6"!.>.P..#..5.@#5"!.L@....'..!.L .@*A.!.!...'5H@'.! .'C@6@XBdD..I ...m.".=&%.(L-.tBC..!..#.1H.!.-.!.'O%..@.%G.!'..(.>)...!.(.6..."8#.1*!.@.?5L!.2...I.'.1.....!.1"!.6.....".jL!.4..9...L!....L .Z!.e" ..._D$H!..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brkitr\word_POSIX.brk

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):44928
                                                                                                                            Entropy (8bit):3.730335600949021
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:TfSX4tmoCZDvcWc/22cAo0VAjkmNVfmyBB+8mpzQVi7IVbHag1jQnwgDo0LJpTCG:LAvjc/22ch0mNVfmyBTg7IVb6rwDA
                                                                                                                            MD5:83B717BB03CBACC3F46CA0DCC6DE0694
                                                                                                                            SHA1:B85FC555A01737A383BE0831708E29F545FA4FA8
                                                                                                                            SHA-256:D2A53C0F3CDDA9BB26EE250268850BB93D6894ABD12D162BC1EA7FB880444851
                                                                                                                            SHA-512:5B63951A368A3A1C699801EB171CAAC3C231EC7BD2CBC975471D32DF111B8272E5B0C5E8BF6547CA0C164E6CF9BAF808343F752FF254C7EB1BB0C7CDF06057D2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:...'........Brk ........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ................P.......`.......0....z..`.......0...0...........................X...@....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!.............................................".#.$.........%...&.......'...................................................(...........................................).*.......+.........,...!.......................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\brx.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2524
                                                                                                                            Entropy (8bit):5.2701530855113665
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:6yf85nMv8XU/fqi2hTaMM+IHIFItfG/yfUXf6H25F25UTqWoQ9QRi67iseKxVpj8:nfQMEE6i6zLIHIFOGE8K2f2++X6A3xf4
                                                                                                                            MD5:731AFEFD7454289F3CC687C346CD39F4
                                                                                                                            SHA1:65334A4EDB35875090C86F614613C1DCC869BB10
                                                                                                                            SHA-256:18E42CAEBB99B8A45635209D37BFC8E6AF5CCEF3F100FF5C6C29F301943E19F9
                                                                                                                            SHA-512:D566BE6FC70D4BA28A387165B5ACCCEFC9473DCD18742351EA789F9A09B948AD9566D50E5E138A418E2945C3126926383E3151075BD9169875E5476C92EE1F5F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................_.. ........o...o......................................A.....G...8.A...&.?...+.G...........>...8.(...8.....+.A.....0.,.?.....A.(...&.>.(...+.A.8...,.A.&...8.>.(.....8.>.0.....8.?.(.....>.%.?.....G.%.K...&.?.(.H.........2.....>...K.....H./.>...8.A.(.?...8.H.%.K...-.>.&.M.0.....>.0.M.8.......%.,.0.......8.M.%.....(.8.K.2.....>.,.K.(.....A.2.>.......L.%.>./...+.>...A.(...,.?.8.%.?...,.K.8.K.0.....?.(.?.%.../.A.....8...0.?.....>...8...,.>.0...8.>.5.A.(...8.A...A.0.......>.9.M.(.....+.M.0.?.2...,.A.&.,.>.0...0.,.?.,.>.0.........2.,.>.0...8.A.(.?.,.>.0...8.G...G.(.M.&.....>.(.A.5.>.0.@...(.,.G...M.,.<.0...,.?.8.%.?.,.>.0...8.A...A.0.,.>.0.....8.>...*.B.0.M.5...&.?.8.G...M.,.<.0...8.,.%.>./.9.,.%.>...+.A.../.,.G.2.>.8.G...8.G.,.%.G...M.,.<.0...M./.d./.y.y. .G.G.G.G.G...,.H.8.>...K./.,.H.8.>.....8.*.M.$.>.9. ...G. .&.?.(.....?.%.>.0. ...?.2...?.%.>.0.....>.5.8.G./...K.(.M.&.K.(.H./.,.>.9.>...K.(.H...8.?.%.>.8.G./...K.(.M.&.K.8.G./.,.>.9.>...K.8.G.....>.5.%.>...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\bs_Latn_BA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXEl0t6E7lFEKe:SvKM0t6gCKe
                                                                                                                            MD5:CF788FA9793FEA6104E904FBA48B9ADE
                                                                                                                            SHA1:5105A53F269A6C445FE58F0AB7BB501BF5790960
                                                                                                                            SHA-256:D49D36962528CD70E638FE62C2A675838D5F6D13C229F6A107530D58C458D100
                                                                                                                            SHA-512:B07CED3B04E2CE33B0FA215AE03002E666D5408F31ADE8FE84F46E2A7474D277B40887F090D5DB6ABEA58B6A8DF385F952DD614979AD903AAF31B524A06AA93B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ceb_PH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmsll86E7lXyEKd:SvUl86g1Kd
                                                                                                                            MD5:D4EF453530AF778ADA54DF1AFC64F304
                                                                                                                            SHA1:E1C2A9D54D408736B091C1BA4740CB054FD437CD
                                                                                                                            SHA-256:78FC4219ECA73162DDE17627148AB0B2266CCB80664007082C496BF5BEC35D7E
                                                                                                                            SHA-512:8BA387125D94E0279B1C930CB6BF46EA088F4BEEBB3C337C160935265DC114B9AE14F70B73403D797E2E6871F9E57114CEFD999766E0AA6E6B66D6AA0DB23DAA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.g$...................g$...........o.f$

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\cgg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1216
                                                                                                                            Entropy (8bit):5.590841534558597
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:p+tAIL3kZtYT7tqi/7ttsMteFsMv4YvCKmXWz5aVe:p+tp3otYdZiMteKMwYaKmnVe
                                                                                                                            MD5:E0DFF04FF2604F608A3A5C0FDDBDED6A
                                                                                                                            SHA1:C47515029521BABB1ABE9A847C31BFEB15200F1F
                                                                                                                            SHA-256:E8C2681948310652DD8A897CB5290DF17C6EFAEDBDB4353AF0085D8EA9673EB7
                                                                                                                            SHA-512:A762B339223E41F558B9C45143A3AC9A3F3AF67ED157922083922E59102A933BD6783B39356EAF239EA167AE192B64FDA56B3D69D7C1A3DD71790F326C67A25E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .m......(...(.........m..........K.B.Z...K.K.N...K.M.K...K.M.N...K.M.S...K.M.W...K.N.B...K.N.K...K.S.T...K.T.N...O.K.B...O.K.N...O.K.S...O.K.T...O.R.K...S.A.N...S.a.n.d.e...E.s.a.n.d.e...S.h.a.a.h.a...E.i.z.o.o.b.a...K.W.O.T.A. .1...K.W.O.T.A. .2...K.W.O.T.A. .3...K.W.O.T.A. .4...O.b.u.n.a.k.u...E.r.i.z.o.o.b.a...O.k.w.a.k.a.n.a...O.r.w.a.k.a.n.a........)..k..)...4.wEy..................................!.$...0............... .'./..4....eN>...D....L...3..].N..).P.M.Neh.4......k..)...4.wW*eh................................!.$...0............... .'./..4....eN>...D....L...3..].N..).P.M.Neh.4..................4=Y0.=...=(=..>.....>......4..j.R......}..n.1...r..v.~.z..M.......=80.<...<.<1I.<C0t%..l...G.A..4D..4G.G.D.>.J.../...^.a.d.g.............h.~.................H....<..<....Y.........................................<................P....... ...............P............%.......-.............. ... ........5...8...........;...H.......U.......

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\chr_US.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ckb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2972
                                                                                                                            Entropy (8bit):5.691547237370157
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:8+57Ti6hKtR1VnDX21mRcMos/sjwHMdoY49byjfWq3msmUP7Eiax3IEvQnHy6:896hKt5nDm1mR66stoz9Wjf3XV7o+znt
                                                                                                                            MD5:F735BD73284F4065E64F3D375C0E4210
                                                                                                                            SHA1:7BE091A1D85A8FB82C900C2F5D0A2DB7C308DF79
                                                                                                                            SHA-256:33CB15B76BAD8153EEF788FAEB02B60F160F126C13D22E0E63724290C49B6651
                                                                                                                            SHA-512:0F19A72BFF06D44BA351BCE5F92E07D05B9250AE118221DCFE4A3DBC0EB7345024FBD18F392E9C5F017ECB416E9F25B6D7506BBA7D9320F2762F643841E74BB7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .*..............).....*..........&...........~.....a.....b.....c.....d...a.4...b.4...c.4...d.4...e.4...(...F.../...F...&.'.(...h... .a...&.'.2.'.1...&.'...'.1...4.H.(.'.*...F...3.'.F.........F.....*...E.H.H.2...E. .d.....E...2.'.....F.....3...4...E.E.....&.....D.H.H.D...-.H.2.....1.'.F.../.H.H.4...E.E...........4...E.E.....d.. d... .M.M.M...~...F.,.4...E.E.......H.'.1.4...E.E.....~...4. .2.'.....F...M.M.M.. M.M.M... .y...d.. d... .M.M.M... .y.....'.1....... .3.....E...*.4.1...F... ./.H.H...E...*.4.1...F... .........E.....'.F.H.F... .........E...E... .d... .M.M.M... .y...G...A.*..... .w. ... .Y.....'.1....... ./.H.H...E.....'.1....... .........E.....'.F.H.H.F... ./.H.H...E.....'.1....... ...H.'.1...E...G...A.*..... .W. ... .M.M.M.M...M.M.M... .y. .. .M.M.M... .y...d... .M.M.M. .. .d... .M.M.M... .y...E... .d... .M.M.M. .. .E... .d... .M.M.M...4.[.. . .K. .L. .M. .N. .O. .P. .Q. .R. .!. .". .#. .$. .%. .). .+. .0. .5. .6. .7. .8. .C. .G. .I. .J.].

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ckb_IQ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ckb_IR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):180
                                                                                                                            Entropy (8bit):4.431161922194599
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlR2xaluljwPgOZM7tvyi24OPnYZi2Pc3nslulAlv5cjXPpKlF7lF:SvM8UVw4Oy7Ryi24OvEi2Pc3nV696I7F
                                                                                                                            MD5:5AF72DD2B31240203880C30AB8512748
                                                                                                                            SHA1:3828F5D086D39C4727477D9755704CFCA51FF409
                                                                                                                            SHA-256:97C35776A37D70FC5BADB8F9128B8BC5E940467BB493FFF013300A62CA7344D0
                                                                                                                            SHA-512:6C7F35187752BE14ED2E2A64D6F5BC57E1C3DB94194C7F3827DE02EC2C0F960755102E55269405DC6AADA6FC4BAA7DB373E47626B7212E9AC85EA83FDA9A11AA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................!.. .%......%...%.........%............k..)...4CwH...k............k..)...4Aw.I..$...............................t.`......`... ... ..o.w...*..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\ars.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.64671783887604
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlW/lRl/jlklbl+3N/lnPn:SBtkJGtaaPn
                                                                                                                            MD5:AA8A7AA673D89EF3789A8F51E0A80829
                                                                                                                            SHA1:052FC49617344392438BD75F84E6F7662C50D294
                                                                                                                            SHA-256:0C3E87EC57077F2273433A6859EA6DDD7AFC5B2A272E475EDA076833239882C5
                                                                                                                            SHA-512:B96A6BF5258AF5D6EE582E2EF722F31017DC8FE8CAAF92A912AADB4E38E10645F451FCCAB8FC5EE95B48DF52A2A9E760F12C4255EC80B03BEF791C6551227CB5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...a.r..... .....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\bo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.751008663818094
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlu12Ol/8klclsX+RZlUlUvk:SBtkJK2Ol/8sU2cwll
                                                                                                                            MD5:102C528C9F8554CEF4474E7E10BB6A07
                                                                                                                            SHA1:D9F58057FEB38913D2F40935781934FCFBC69488
                                                                                                                            SHA-256:E80DE3D6D7DE0D2D0E8123CA081BCEA0BA849D3F08ABA660D5B93F3896FE10BE
                                                                                                                            SHA-512:EE971EBE616AED4CFA017A6C851AEC81C411525FE15D776BDEE19354B7FC951F9493AE13FB71B26F954F91CC247E4BBCFDEEFBD817E55D8400C284460EE39C9A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................Version...2...1...2.3...4.7..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\bs_Cyrl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6816
                                                                                                                            Entropy (8bit):3.1812041917040403
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:CqEDfLTTLTD5Tf7fTL377fTLKHSGz5Y3pnEoTKAGIhr3C:Cq0f33P5ff33Pf3gY5b1LC
                                                                                                                            MD5:F0748CA6B45F4ACCDB0A82D6D0206B61
                                                                                                                            SHA1:5303AAFFA8752402FD58D793AA754E673977F75D
                                                                                                                            SHA-256:DCF701064EEED5096988453045FDEE7448C3E1ADCF8885C312AFDADDD89BBB3E
                                                                                                                            SHA-512:86182697A0547823064E216BB4B92459DEB3E74D416AC25CA44B01A8DD3712D14EB76F6E7F9943345A1AD40377C2EC43E929E6A35F852923DC2FCEDE877AC4A3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................"...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...[.i.m.p.o.r.t. .s.r.]..............'........UCol.....`#...... ..............4...8...8...X...X...X...X........................................... !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`'bcdefghijklmnopqrstuvwxyz{|}~.................................................................................................................................2irT..@.y...............0.8.@.H.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.P.X.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\ceb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8268
                                                                                                                            Entropy (8bit):3.8068001682596955
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:yThSGz8bppIKNToAGI1IBXapu5uk0c0HXkqqkTXAAcN4CSkjak3WICy7y8NYTosV:yYTrCyhkqqkTXNcNpSk+8NI8NYsM
                                                                                                                            MD5:E49D16830A825EEFD584C06F60D8A621
                                                                                                                            SHA1:6DDDEE5ECAFE01B4E8CF999AE1D050522CBC9665
                                                                                                                            SHA-256:4BEB717D54843C7F7E07A3E70CD33323FC5F634948277B5DC6B2F7BDD2EA7B15
                                                                                                                            SHA-512:935E468C1507AE3004AC52AD8786C74E2DA43B5817DCCDA81A1B64404C7138186B82CBCA04A744978509F2E436E77089C05812CD280FC8AD1A1085F5D150B652
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................'...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...4.8...6.7...&.N.<...<.<.<...<.n.g.<.<.<.N.g.<.<.<.N.G...^......'........UCol.....`#...... ..............D...D...D........................... ...:...F...2irT..@.................0.8.@.H.0.8.P.X.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.o.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\chr.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):560
                                                                                                                            Entropy (8bit):6.471097376622729
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:WXNR0L3Omtmq103+54vmkCNMvWRQzaLhMvmNKzuxBJB16LO5yG9YmorO0+7ymBAh:W96Osd+OmvmLeO22LSeKufL6uL9iv+70
                                                                                                                            MD5:5C0CEE0EEE7A296F1FBD31BE1BCAA7DB
                                                                                                                            SHA1:DA0BBFBED073C0F9CCAA3DA5F389284216B49370
                                                                                                                            SHA-256:449FCA345D2D6E5C61E2B05353A0D485AE4C9113C1CD453F56F849B51617F5CA
                                                                                                                            SHA-512:71573BE3B0927BACBF83D15E20ABE60276691E3EB9C6985B0A161B9BCDB4F15BC38A3C91180EF10A2C4283F90823ABD7049A5BD513A8A8E59205276BC1474C3F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................$...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...[.r.e.o.r.d.e.r. .C.h.e.r.].................D......'........UCol.....`#...... .............. ...,...,.........6v...v................................ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstu.wxyz{|}~...................................................................................................................................E.<. .'......`...`..3.y.. .. .(......`~..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\de_AT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9704
                                                                                                                            Entropy (8bit):3.621097460230965
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:i6MGRSGzR8fy3/ZAGILxA+qPXu3LjmEuLnj6ouwj2+hRxr226i+f/YijF:iGETxA5bl1VRfaYs
                                                                                                                            MD5:46CFAFA533753A2D182AAE7427D364EB
                                                                                                                            SHA1:F0784B7C037F256119434D8F84608D79D5E83D3F
                                                                                                                            SHA-256:34C8D91C847E6CFE66F7F69198A8586202F04A20554E76113B634612CA528767
                                                                                                                            SHA-512:9EFC02F5C8B30DA304849582CB1655E7925A5635302E172BEF5F275E0852DEE645B9DAE8123E96B958DA634110CE15049F3E46EA9DDA71A30FD41F6BE97470D9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................n.. ........r...r...............Version.collations.phonebook.Sequence.%%CollationBin......3.5...2...1...1.9...1.4...&.a.<...<.<.<...&.o.<...<.<.<...&.u.<...<.<.<...&.s.s.<...<.<.<..........$.....'........UCol.....`#...... ..............D...D...D...d...d...d...d...0...0.... ... ...$..2irT..@.................0.8.@.H.P.X.T.\.a.i.n.v.y...0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0...........0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\dz.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.7234597887964593
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlu12Ol/8klclsX+RZlUlnBlk:SBtkJK2Ol/8sU2cwlBlk
                                                                                                                            MD5:74852472ABC6DD63B12C4766472C9B74
                                                                                                                            SHA1:5B59504CCCC2A557A39AB15BFFAC0270D4E4014A
                                                                                                                            SHA-256:BD31F37629AFE5B5CA7801F26F251980F6F6A737C01C3C5BE19E10B8F4840F00
                                                                                                                            SHA-512:80E3F257A80030BECD995377E912BCB62940C2819CEE559441CD3B9A141229A7E071FA75B91B4B868DCDBFD00AC389F5250C7D49D0F8096E8CDF9B045523D0DB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................Version...2...1...1.9...1.4..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\ee.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):11632
                                                                                                                            Entropy (8bit):4.077590020245211
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:XWh0Y4faHsQC3mMPE7IsGIyQ1i0lPxbHGk:qaj93mMPE7IjI51iGdGk
                                                                                                                            MD5:1DAC841377561C45224B1493C035E0EF
                                                                                                                            SHA1:B63E8D3CEA6C4DF2BDCB720901A3071A3CE21AB8
                                                                                                                            SHA-256:7843392DD3FFA62E4318C4CB22FAD1381380106FD2252B0A31039AD387994D28
                                                                                                                            SHA-512:FD5F29F450AA883F3A6EF415D740A4331DF9104CB9F172D45CE623396A6F66D02AD287417F636905DF46D0FFC820E01BF4AF64BADC9B8C8EF48027A22ACEFC1C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................P.. ........T...T...........b...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4.....&...<.<...&.D.<.d.z.<.<.<.D.z.<.<.<.D.Z.<.V.<.<.<...&.E.<.[.<.<.<...&.F.<...<.<.<...&.G.<.g.b.<.<.<.G.b.<.<.<.G.B.<.c.<.<.<...&.H.<.x.<.<.<.X.&.K.<.k.p.<.<.<.K.p.<.<.<.K.P.&.N.<.n.y.<.<.<.N.y.<.<.<.N.Y.<.K.<.<.<.J.&.O.<.T.<.<.<...&.T.<.t.s.<.<.<.T.s.<.<.<.T.S.&.V.<...<.<.<..........+.....'........UCol.....`#...... ..............D...D...D...................t#..t#...&...&..z+..2irT..@.................0.8.@.H.P.X.^.f.m.u.0.8.0.8.z.......0.8.....0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\en.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.7234597887964593
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlu12Ol/8klclsX+RZlUlnBlk:SBtkJK2Ol/8sU2cwlBlk
                                                                                                                            MD5:74852472ABC6DD63B12C4766472C9B74
                                                                                                                            SHA1:5B59504CCCC2A557A39AB15BFFAC0270D4E4014A
                                                                                                                            SHA-256:BD31F37629AFE5B5CA7801F26F251980F6F6A737C01C3C5BE19E10B8F4840F00
                                                                                                                            SHA-512:80E3F257A80030BECD995377E912BCB62940C2819CEE559441CD3B9A141229A7E071FA75B91B4B868DCDBFD00AC389F5250C7D49D0F8096E8CDF9B045523D0DB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................Version...2...1...1.9...1.4..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\es_.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.1584082049584112
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDtM86E/lWlRKOt:SBtkJztt6siRKa
                                                                                                                            MD5:446A3139B2628B0370B88DEDED4D5382
                                                                                                                            SHA1:73A290ECC02BE29B6E9DEDD1DDE7B0633CB5D5A8
                                                                                                                            SHA-256:5107405E84E52F18E47AA7071F183E499A2C325E6E4BDA7FCA2B59ECB55D81D7
                                                                                                                            SHA-512:6E6CBE46747664442464BCCB8DC93DFAD4A786C6AC390EDA705C083498C898FF0D9083AFA411E800F1DFC1DB10799BEE110E7C5371B3F559A806D72D42CDEB0C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................___..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\fr_CA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):252
                                                                                                                            Entropy (8bit):3.8923972437714607
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SBtkJbAUMXfRWv80lbl+lSlGZkgFsJtgylf:WCAUMPR0oSMc5lf
                                                                                                                            MD5:A76CCF6803C6297FDBDC90FCAA2C39A8
                                                                                                                            SHA1:7156D4D3C55372EF3765D290A098EE994DF34FFE
                                                                                                                            SHA-256:F6B660BFAC93F4580444EBA04DE3C650C826F8891999302E3CCD0583D7DDF7F7
                                                                                                                            SHA-512:862AAF133C9CC9D157ABB4B7C20EBA0F0F36D55D7B86A32770530096980986FF9CEB4F199D6902B539AAC541D6784BCA4E24ED73CF7DF27F6F3635F97BE4BD81
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................3.. ........7...7...........#...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...[.b.a.c.k.w.a.r.d.s. .2.]... ......'........UCol.....`#......(....E.<. .#......`...`..3.,.. .. .(......`1..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\gl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17104
                                                                                                                            Entropy (8bit):3.4874941508467288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:MOlTpkEKjtDwRehrNL0bDbv/oNuiBmXgpqynC8HpYse:MOllbKhcovL0bDbvKui4XSJQ
                                                                                                                            MD5:FD6C94EA946E393251E8CE361AC55866
                                                                                                                            SHA1:5C9044025D9356DBC38C61DA738CEEB2D6520785
                                                                                                                            SHA-256:F13BCB6CC2690A3BB1B5750D1B8ECC9A3F5F70E12119FBFDE7AD3D2D13155CFE
                                                                                                                            SHA-512:3FAFA81C5130C08157CBDF5F257FB4960E50E0491FD47E3A45766E65DBB5A04C3C3F6A3C50C21B4EC1116461683A27EAECC97B32F983C1996BC5CD5FE2A7763C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................0...Version.collations.search.Sequence.%%CollationBin.standard....3.5...2...1...1.9...1.4...[.i.m.p.o.r.t. .e.s.]...[.i.m.p.o.r.t. .e.s.-.u.-.c.o.-.s.e.a.r.c.h.]................#.....'........UCol.....`#...... ..........M...D...D...D.... ... ... ... ..."..."...#...#...#..2irT..@....... .........0.8.@.H.0.8.P.X.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.T.\.b.j.r.z.0.8.y...0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.....0.0.0...0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0...0.....0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\hi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6896
                                                                                                                            Entropy (8bit):3.2718938783920515
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:oBpIEt9ZDfLGWLTDfLvf7fTL377fTLKxASGzFpnEoTxAGIhtS:oBpJbfKGPfHf33Pf3vbktS
                                                                                                                            MD5:84DADD7F294FF77849F71282F0178B2B
                                                                                                                            SHA1:C76A7C957E9C2FE30778F9693524C30E6A0A48A1
                                                                                                                            SHA-256:4B344767F46F079B2A27519FD20BCB714FA53AFA45EB0801335381B5DC5DAEFB
                                                                                                                            SHA-512:7686B8FCDE850416802F162E93426D6E60C52BA09BA23092C02C5016F4ED5E207D451A2C1B53F024D909B77FE4EB2C68D9CEE0601B3E5DEB7C96145D876BCF49
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................H...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...V.[.n.o.r.m.a.l.i.z.a.t.i.o.n. .o.n.].[.r.e.o.r.d.e.r. .D.e.v.a. .B.e.n.g. .G.u.r.u. .G.u.j.r. .O.r.y.a. .T.a.m.l. .T.e.l.u. .K.n.d.a. .M.l.y.m. .S.i.n.h.].&.P.<...<.<...<.................t......'........UCol.....`#.......... ..............4...l...l...................X.......................#...$...........!......)...`...h...q................................ !"#$%&'(123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefgfghijklm'()*+,-./.rstuvwxyz{|}~.................................................................................................................................2irT..@.q...............0.8.@.H.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.`.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\hu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18912
                                                                                                                            Entropy (8bit):5.023090366613305
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:FyvoCH2tLtUy3E5rHgWvwhk4eUAMTpWo2TzrbFS:8vTHMLtF3mrHgw4eUZTpw4
                                                                                                                            MD5:A64E40E2EB99B495EC40D72C0714A276
                                                                                                                            SHA1:2ABF24E2C32A6D35188B3CB990AD2E03C7D1420A
                                                                                                                            SHA-256:2CA044F7DE47CC135785375C2F8A4DE43AEACC76BDCD84778EED23DBF3D51223
                                                                                                                            SHA-512:53CC847A9EB04EBFC1AFCEF221E32A6DB661582D518E7D7CBD97D587A915051BC2F0C6CC154AE56A29CE26F69B475EC4A8AF065A5039B85140FAC74D0BB02D87
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................l.. ........p...p...............Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4.....&.C.<.c.s.<.<.<.C.s.<.<.<.C.S.&.D.<.d.z.<.<.<.D.z.<.<.<.D.Z.&.D.Z.<.d.z.s.<.<.<.D.z.s.<.<.<.D.Z.S.&.G.<.g.y.<.<.<.G.y.<.<.<.G.Y.&.L.<.l.y.<.<.<.L.y.<.<.<.L.Y.&.N.<.n.y.<.<.<.N.y.<.<.<.N.Y.&.S.<.s.z.<.<.<.S.z.<.<.<.S.Z.&.T.<.t.y.<.<.<.T.y.<.<.<.T.Y.&.Z.<.z.s.<.<.<.Z.s.<.<.<.Z.S.&.O.<...<.<.<...<.<.Q.<.<.<.P.&.U.<...<.<.<...<.<.q.<.<.<.p.&.c.s.<.<.<.c.c.s./.c.s.&.C.s.<.<.<.C.c.s./.c.s.&.C.S.<.<.<.C.C.S./.C.S.&.d.z.<.<.<.d.d.z./.d.z.&.D.z.<.<.<.D.d.z./.d.z.&.D.Z.<.<.<.D.D.Z./.D.Z.&.d.z.s.<.<.<.d.d.z.s./.d.z.s.&.D.z.s.<.<.<.D.d.z.s./.d.z.s.&.D.Z.S.<.<.<.D.D.Z.S./.D.Z.S.&.g.y.<.<.<.g.g.y./.g.y.&.G.y.<.<.<.G.g.y./.g.y.&.G.Y.<.<.<.G.G.Y./.G.Y.&.l.y.<.<.<.l.l.y./.l.y.&.L.y.<.<.<.L.l.y./.l.y.&.L.Y.<.<.<.L.L.Y./.L.Y.&.n.y.<.<.<.n.n.y./.n.y.&.N.y.<.<.<.N.n.y./.n.y.&.N.Y.<.<.<.N.N.Y./.N.Y.&.s.z.<.<.<.s.s.z./.s.z.&.S.z.<.<.<.S.s.z./.s.z.&.S.Z.<.<.<.S.S.Z.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\ky.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):7092
                                                                                                                            Entropy (8bit):3.1883641632795445
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:8qnDfLTTLTD5Tf7fTL377fTLKcSGzFpnEoTxAGIhcFSf:8qDf33P5ff33Pf3JbkcFC
                                                                                                                            MD5:DEDF86F20809D515B5441A7A00A9C564
                                                                                                                            SHA1:531629BF1DF847C6B4B746AF23D722B994E3A382
                                                                                                                            SHA-256:9776F4BE2EF5F11A5D03C9B7AFC184D6361D5256BE1140AE1E416CBBA3F7D0E1
                                                                                                                            SHA-512:D8EBD3065D260AAE0A1903CC16E4A441302C7A509A6BA12D83F8D7B6E379ABDD73DCECCCE8E61CEA4F4EC397A062891215FE2416A6AB847881EB340297391A11
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................(...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...[.r.e.o.r.d.e.r. .C.y.r.l.].&.5.<.Q.<.<.<..........................'........UCol.....`#...... ..............<...@...@...@...@...@...@................................................... !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`'bcdefghijklmnopqrstuvwxyz{|}~.................................................................................................................................2irT..@.................0.8.@.H.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.P.X.^.f.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\lb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.7234597887964593
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlu12Ol/8klclsX+RZlUlnBlk:SBtkJK2Ol/8sU2cwlBlk
                                                                                                                            MD5:74852472ABC6DD63B12C4766472C9B74
                                                                                                                            SHA1:5B59504CCCC2A557A39AB15BFFAC0270D4E4014A
                                                                                                                            SHA-256:BD31F37629AFE5B5CA7801F26F251980F6F6A737C01C3C5BE19E10B8F4840F00
                                                                                                                            SHA-512:80E3F257A80030BECD995377E912BCB62940C2819CEE559441CD3B9A141229A7E071FA75B91B4B868DCDBFD00AC389F5250C7D49D0F8096E8CDF9B045523D0DB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................Version...2...1...1.9...1.4..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\ln.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22836
                                                                                                                            Entropy (8bit):4.285576816878592
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:xJPnQ1xOzzU5wXJUUvuX3gl4PWBcVegUa/8m2YS3wG4qDYe/6dWUXmgEOKNaOjIS:jQ/+4aYzlEECIohA5GDpwU
                                                                                                                            MD5:0C4EBC14057AC2AEC1048A688AB10D78
                                                                                                                            SHA1:77C204D54BA7779DD79D606841983297B4340E88
                                                                                                                            SHA-256:E519FD05C4E1B6177533895C767E9E3B3C7F821E509C9CF8989DC8E6CB486EA2
                                                                                                                            SHA-512:8581D0D1A5726C4CD8ADF51C029F68A49BB0FC448815533F39B6997F29AD5C2EB63128C29FBE80A017D40454F06CF3C94BD602FDBF01A675E036A5E3E3E3A96B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................A.. ........E...E...............Version.collations.phonetic.Sequence.%%CollationBin.standard......3.5...2...1...1.9...1.4...&.E.<.[.<.<.<...&.O.<.<.T.<.<.<.....S.&.E.<.[.<.<.<...&.O.<.<.T.<.<.<...&.G.<.g.b.<.<.<.g.B.<.<.<.G.b.<.<.<.G.B.&.K.<.k.p.<.<.<.k.P.<.<.<.K.p.<.<.<.K.P.&.M.<.m.b.<.<.<.m.B.<.<.<.M.b.<.<.<.M.B.<.m.f.<.<.<.m.F.<.<.<.M.f.<.<.<.M.F.<.m.p.<.<.<.m.P.<.<.<.M.p.<.<.<.M.P.<.m.v.<.<.<.m.V.<.<.<.M.v.<.<.<.M.V.&.N.<.n.d.<.<.<.n.D.<.<.<.N.d.<.<.<.N.D.<.n.g.<.<.<.n.G.<.<.<.N.g.<.<.<.N.G.<.n.g.b.<.<.<.n.g.B.<.<.<.n.G.b.<.<.<.n.G.B.<.<.<.N.g.b.<.<.<.N.g.B.<.<.<.N.G.B.<.n.k.<.<.<.n.K.<.<.<.N.k.<.<.<.N.K.<.n.s.<.<.<.n.S.<.<.<.N.s.<.<.<.N.S.<.n.t.<.<.<.n.T.<.<.<.N.t.<.<.<.N.T.<.n.y.<.<.<.n.Y.<.<.<.N.y.<.<.<.N.Y.<.n.z.<.<.<.n.Z.<.<.<.N.z.<.<.<.N.Z.&.S.<.s.h.<.<.<.s.H.<.<.<.S.h.<.<.<.S.H.&.T.<.t.s.<.<.<.t.S.<.<.<.T.s.<.<.<.T.S......<.....'........UCol.....`#.......... ..............D...D...D...t...t...D!..D!...)...)...5...5...;..2irT..@.................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\lt.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10280
                                                                                                                            Entropy (8bit):3.8442671385451366
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:e/mFraymPmDPQOwdhEn8Qm5aqPNssWB5+CYEZ:eUrJmPmDoOzm5acssgww
                                                                                                                            MD5:453D55D7BB47B2B7BC2FD3EBA4E4A1E2
                                                                                                                            SHA1:0BC5C02A06018B466F3D673EF209E93D32779D6C
                                                                                                                            SHA-256:FC6A6BC9A00735D6D9538BBDC78DABE54390851BE06CFCF06FF000131E6DDB8D
                                                                                                                            SHA-512:5FB8EB180F72B4ACDB2AC5BF051209F11C0FDD100F9EE0BFFBA951D9C9AD2B944A69D969613C2742568E1CD46B1F6AF6E4FF4F7DA6B3DF9B8DA1E199A75CCA1A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................M...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...`.&...=.....&...=.....&...=.....&.A.<.<...<.<.<...&.C.<...<.<.<...&.E.<.<...<.<.<...<.<...<.<.<...&.I.<.<./.<.<.<...<.<.y.<.<.<.Y.&.S.<.a.<.<.<.`.&.U.<.<.s.<.<.<.r.<.<.k.<.<.<.j.&.Z.<.~.<.<.<.}............&.....'........UCol.....`#...... ..............D...D...D...........................b"..b"...&..2irT..@.................0.8.@.H.P.X.\.d.l.t.0.8.y...0.8.0.8.0.8.....0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0.......0...0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\mk.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):7248
                                                                                                                            Entropy (8bit):3.275547854208499
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:jPvMcDfLTTLTD5Tf7fTL377fTLK5SGz5Y3pnEoTKAGIhgxXR4FDR:jPvZf33P5ff33Pf3eY5b1kGDR
                                                                                                                            MD5:EA2B7DDCB4A733DA59B0FF62CC497175
                                                                                                                            SHA1:4885A7DCB1D0F111FB53474AD6FEAC075B3D8206
                                                                                                                            SHA-256:2AEFB3248516F9E2527A8C1AB7EF96E9BDDF123D745310776041F096F15527AA
                                                                                                                            SHA-512:3630F610DCDCF922330BC69CEA22D012FF5A06B255E8B96A5220E94C1FE73D4799BD305BB109CA97FBA551AF057F9D6DD57E8B4DC12E512E83A32444703C082D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................:...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...9.[.r.e.o.r.d.e.r. .C.y.r.l.].[.s.u.p.p.r.e.s.s.C.o.n.t.r.a.c.t.i.o.n.s. .[...8.].].&...<.S.<.<.<...&.[.<.\.<.<.<..................'........UCol.....`#...... ..............<...@...@...P...P...P...P................................................... !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`'bcdefghijklmnopqrstuvwxyz{|}~.................................................................................................................................2irT..@.................0.8.@.H.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.P.X._.g.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\nl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.7234597887964593
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlu12Ol/8klclsX+RZlUlnBlk:SBtkJK2Ol/8sU2cwlBlk
                                                                                                                            MD5:74852472ABC6DD63B12C4766472C9B74
                                                                                                                            SHA1:5B59504CCCC2A557A39AB15BFFAC0270D4E4014A
                                                                                                                            SHA-256:BD31F37629AFE5B5CA7801F26F251980F6F6A737C01C3C5BE19E10B8F4840F00
                                                                                                                            SHA-512:80E3F257A80030BECD995377E912BCB62940C2819CEE559441CD3B9A141229A7E071FA75B91B4B868DCDBFD00AC389F5250C7D49D0F8096E8CDF9B045523D0DB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................Version...2...1...1.9...1.4..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\om.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10344
                                                                                                                            Entropy (8bit):4.271419544171399
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:PhOspqyPOFaeZUBIX9vaUscbxbKY3zcv//cpQwR48zxYWADv:PwspqvNv3sNWzeHmQv
                                                                                                                            MD5:DD7365352475EA3DD2767F13F41FB976
                                                                                                                            SHA1:97E4EAD03857C51932E0DFA8ED58587AC67F96B6
                                                                                                                            SHA-256:62928E142E473D98A1F85FA88DF103F40694042906F2377EA38A65CE3580C86F
                                                                                                                            SHA-512:719450846B7570A0846BE408940F28452A3800C4E1D13A251A04F96A29DF835AB7E6B0972C94BD70B48C682D1503D5451776C32E69BC7658CC978F0C6B33221D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................C...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...K.&.Z.<.c.h.<.<.<.C.h.<.<.<.C.H.<.d.h.<.<.<.D.h.<.<.<.D.H.<.k.h.<.<.<.K.h.<.<.<.K.H.<.n.y.<.<.<.N.y.<.<.<.N.Y.<.p.h.<.<.<.P.h.<.<.<.P.H.<.s.h.<.<.<.S.h......'.....'........UCol.....`#.......... ..............D...D...D............................"..`"...&..2irT..@.o...............0.8.@.H.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.^.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\or.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):7040
                                                                                                                            Entropy (8bit):3.2963712387128243
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:/A+knETvBDfLGWLTDfLW6f7fTL377fTLKkSGzFpnEoTxAGIhqjz:/A+k0fKGPfzf33Pf3hbkqjz
                                                                                                                            MD5:DF68A691D69D309CC5973650F2A8D877
                                                                                                                            SHA1:6BBB69818D12FE9BF2A858863F5CCC9C11643E30
                                                                                                                            SHA-256:2029F6CB4B7BD08C58B87488342291AF11CE67DBFBE7BC7A6981375FE81E71EB
                                                                                                                            SHA-512:425430AD9EC214FBFDB0BAB62DE7598CBCDB535AC618B2DEF59579BED521891453CDB41A0A951058C215182BDAC88D2204A822B3A4D9324C93CB58C4BABD4300
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................M...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...`.[.n.o.r.m.a.l.i.z.a.t.i.o.n. .o.n.].[.r.e.o.r.d.e.r. .O.r.y.a. .D.e.v.a. .B.e.n.g. .G.u.r.u. .G.u.j.r. .T.a.m.l. .T.e.l.u. .K.n.d.a. .M.l.y.m. .S.i.n.h.].&...<...<...<...&.9.<...M.7.&./.<.<._..................'........UCol.....`#...... ..............@...............................................................#...$...........!......)...`...h...l...m...q................................ !"#$%&'(123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefgfghijklm()*+',-./.rstuvwxyz{|}~.................................................................................................................................2irT..@.w...............0.8.@.H.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.`.0.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\pa_Guru_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.1584082049584112
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDtM86E/lWlRKOt:SBtkJztt6siRKa
                                                                                                                            MD5:446A3139B2628B0370B88DEDED4D5382
                                                                                                                            SHA1:73A290ECC02BE29B6E9DEDD1DDE7B0633CB5D5A8
                                                                                                                            SHA-256:5107405E84E52F18E47AA7071F183E499A2C325E6E4BDA7FCA2B59ECB55D81D7
                                                                                                                            SHA-512:6E6CBE46747664442464BCCB8DC93DFAD4A786C6AC390EDA705C083498C898FF0D9083AFA411E800F1DFC1DB10799BEE110E7C5371B3F559A806D72D42CDEB0C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................___..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\ps.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9152
                                                                                                                            Entropy (8bit):3.9385991206484325
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:+iXmyf33Pfoff33Pf3/Y5b1l5zbl6BpQoRw8YsYV:+oHnQnEb17I/E
                                                                                                                            MD5:140A3116DEE46D196904D5B3BC64DC4B
                                                                                                                            SHA1:473C9FA7A84CFC5CD61E43FF88B5CAEDACFB2D7F
                                                                                                                            SHA-256:4B85DE155ABD4F10DC2CE39E96F2203B4D7F55FE577B2C99B94CDD8819525ACA
                                                                                                                            SHA-512:C69C3EB4CDB45434473C623E75DCE326653E04649B229470D3493695F8E07858F2BDAE377E5353C09D24CCFB0A475559039C16DC757B9524B4285FC9F326DB34
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4.....[.n.o.r.m.a.l.i.z.a.t.i.o.n. .o.n.].[.r.e.o.r.d.e.r. .A.r.a.b.].&.N.<.<.P.<.<.O.<.<.K.<.<.M.<.<.L.&.[.b.e.f.o.r.e. .1.].'.<.".&.'.<.<.#.<.<.r.<.<.q.<.<.%.<.<.s.<.!.&.*.<.|.<.<.y.&.,.<...<.<.-.T.&...<...&./.<...<.<...&.1.<...<.<...&...<...&...<.<.*...C.&...<.<...&...<.<...&.H.<.<.$.<.<...<.<...&.G.<.<.<...<.<.<.G.T.<.<.*.......)...&...<.<.*.I...J.....<.<...T.<.<.<.I.T.<.<.<.&.&...<.<.. <.<.. ................d!.....'........UCol.....`#...... ..............D...H...H...................................L!...................................... !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcde'ghijklmnopqrstuvwxyz{|}~.................................................................................................................................2irT..@.................0.8.@.H.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\pt.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.7234597887964593
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlu12Ol/8klclsX+RZlUlnBlk:SBtkJK2Ol/8sU2cwlBlk
                                                                                                                            MD5:74852472ABC6DD63B12C4766472C9B74
                                                                                                                            SHA1:5B59504CCCC2A557A39AB15BFFAC0270D4E4014A
                                                                                                                            SHA-256:BD31F37629AFE5B5CA7801F26F251980F6F6A737C01C3C5BE19E10B8F4840F00
                                                                                                                            SHA-512:80E3F257A80030BECD995377E912BCB62940C2819CEE559441CD3B9A141229A7E071FA75B91B4B868DCDBFD00AC389F5250C7D49D0F8096E8CDF9B045523D0DB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................Version...2...1...1.9...1.4..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\ro.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9028
                                                                                                                            Entropy (8bit):3.7670032895856154
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:BVe6MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMb:BVR7vBnmfO5npz8ZYGn
                                                                                                                            MD5:71C97109D89ED5276BEA459B00925B66
                                                                                                                            SHA1:3DC2DBF60B81BE424FBE043DD3E3FD6F6E690952
                                                                                                                            SHA-256:50A1B2397DD35328A10CA0E7665AFD5C7BDA8C56A45082EFE6F6ABC117EC0128
                                                                                                                            SHA-512:F0D3CAFAE7139A0BE42183624F42E8C82CA85722B0C1604B3BD04D317E47A732C1ACFC32A0F349E02791609C68A893CAFE8AF2D642A4871D390F284C233AEB90
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................4...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4.....&.A.<...<.<.<...<...<.<.<...&.I.<...<.<.<...&.S.<._.=...<.<.<.^.=...&.T.<.c.=...<.<.<.b.=..................".....'........UCol.....`#...... ..............D...D...D...t...t...t...t....................!..2irT..@.................0.8.@.H.P.X.\.d.0.8.0.8.f.n.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.....0.0.0.....0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\ru.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):552
                                                                                                                            Entropy (8bit):6.475698706545024
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:Wh/ThR0L+lq103+54vmkCNMvWRQzaLhMvmNKzuxBmLO5SfG9YmorO0+7ymBADOMt:Wr1w+OmvmLeO22LSeKuIuS+iv+7ym2/t
                                                                                                                            MD5:3C36DD32064B9ABC9700B51EBFDC9FEB
                                                                                                                            SHA1:3020CA291091B8175BD6282DFBCB7AB1A2E8509F
                                                                                                                            SHA-256:5473E753D24D1B03BB1B0ABFE4D9FD14377507B1FF19AADB2C35C57440858766
                                                                                                                            SHA-512:D079635B3766020E7F3C4C9B95934D692045E4083026AC570E9BA14D16BBCAA41EF1E1F0090BA09BCE4F11A95CCFED1CEC40E30AEE34525DBE957F302EE04588
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................~.. ........................$...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...[.r.e.o.r.d.e.r. .C.y.r.l.].................<......'........UCol.....`#...... .............. ...$...$....................................... !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`'bcdefghijklmnopqrstuvwxyz{|}~...................................................................................................................................E.<. .'......`...`..3.w.. .. .(......`|..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\se.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):29156
                                                                                                                            Entropy (8bit):4.012114656235891
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:TOoHoNZ/vAKnvna0bDbs/nEYYaHDLWbrAiKmEYYRMkxx:6oHoNZXAunhHs85aHfWbEiK55/xx
                                                                                                                            MD5:BF2D357381E33C4A78C716114D3B3119
                                                                                                                            SHA1:6F701CBB897FE58A8D4AB3AD352AAA20A9B6F0EE
                                                                                                                            SHA-256:B8EC2BC354DE81801377879E0C950167CCE4C3B899FCA3881EAF95EBC85EE1AF
                                                                                                                            SHA-512:D35D36C9068307F85057B78FCD704A289424AE43850B5EB876586F11B562AAFC9162551FB14BC0C8B79592FB69F108F7B5130240F16B436929F421B21049FB1A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................m.. ........q...q...............Version.collations.search.Sequence.%%CollationBin.standard....3.5...2...1...1.9...1.4...1.[.i.m.p.o.r.t. .u.n.d.-.u.-.c.o.-.s.e.a.r.c.h.].[.i.m.p.o.r.t. .s.e.-.u.-.c.o.-.s.t.a.n.d.a.r.d.].../.&.[.b.e.f.o.r.e. .1.].b.<...<.<.<...&.[.b.e.f.o.r.e. .1.].d.<...<.<.<...<...<.<.<...<...<.<.<...&.[.b.e.f.o.r.e. .1.].e.<...<.<.<...<.<...<.<.<...&.[.b.e.f.o.r.e. .1.].h.<...<.<.<...<...<.<.<...&.[.b.e.f.o.r.e. .1.].l.<...<.<.<...&.[.b.e.f.o.r.e. .1.].o.<.K.<.<.<.J.<.<.D.<.<.<.C.<.<...<.<.<...&.[.b.e.f.o.r.e. .1.].t.<.a.<.<.<.`.&.[.b.e.f.o.r.e. .1.].u.<.g.<.<.<.f.<.<...<.<.<...&.y.<.<...<.<.<...<.<.q.<.<.<.p.&.[.b.e.f.o.r.e. .1.]...<.~.<.<.<.}.<...<.<.<...<.<.S.<.<.<.R.<...<.<.<...<...<.<.<...<.<.'.<.<.<.&.<...<.<.<...<.<...<.<.<...<...<.<.<...<.<.Q.<.<.<.P.<.<...<.<.<...<.<...<.<.<...<.<...<.<.<..................9.....'........UCol.....`#.......... ..............D...D...D....(...(...-...-..83..83...9...9...9..2irT..@.|..... .........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\sh_CS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):2.8358718455819605
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtl6/NlXelbONglLMhll+fEPn:SBtkJK/6vJQWOn
                                                                                                                            MD5:22828A7D641C2B46CAF27EE76D771B0B
                                                                                                                            SHA1:5C2C34608ED1161E4BD7CD471BAB22258BB86933
                                                                                                                            SHA-256:2FF2317B37FBFA2470A02052DF89CEC26CEC78BD8A30BCDBDC36D8D874A84D04
                                                                                                                            SHA-512:B77FFA9EDA88505A1CB29C2B00F1A29B4D415972C4EBC2FE04889F8601C771EC9BD11956D7334A0A474766CF33BB3ABAD2715B0358BCF9676126AEC9132E226F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...s.r._.L.a.t.n._.R.S..... .....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\sk.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25664
                                                                                                                            Entropy (8bit):4.016149774524455
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:zOG2ydsJRFpmi0vO0bDbPNH3Z2nkhiSkkW1Za4uimCvlIeJjHi:aGHdsvmiO9HVXZXQzs1CvSeVC
                                                                                                                            MD5:690C0062EEAFA49C713EC2AED29633CC
                                                                                                                            SHA1:90AAAC8469535DE0DA1DB8F1A4347F295201A4F9
                                                                                                                            SHA-256:EA32904D79FE915AD2C0F04A378C376F4855BEB578505A374DFCBC2C0D790CDB
                                                                                                                            SHA-512:9B38CDBF60D53730EC3FA7F36367C651A7C8148681900A4D8126FCCFEEDCDCF3A3CBB2AA85DBC74F9BD273DE9F8CDD185F552C56C03DFA2FA749B519B4E2194D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................Version.collations.search.Sequence.%%CollationBin.standard....3.5...2...1...1.9...1.4...P.&.A.<.a...<.<.<.A...&.C.<.c...<.<.<.C...&.H.<.c.h.<.<.<.c.H.<.<.<.C.h.<.<.<.C.H.&.O.<.o...<.<.<.O...&.R.<.r...<.<.<.R...&.S.<.s...<.<.<.S...&.Z.<.z...<.<.<.Z.......[.i.m.p.o.r.t. .u.n.d.-.u.-.c.o.-.s.e.a.r.c.h.].&.A.<...<.<.<...<...<.<.<...&.C.<...<.<.<...&.D.<...<.<.<...&.E.<...<.<.<...<...<.<.<...&.I.<...<.<.<...&.L.<.:.<.<.<.9.<.>.<.<.<.=.&.N.<.H.<.<.<.G.&.O.<...<.<.<...<...<.<.<...&.R.<.U.<.<.<.T.<.Y.<.<.<.X.&.S.<.a.<.<.<.`.&.T.<.e.<.<.<.d.&.U.<...<.<.<...<.o.<.<.<.n.&.Y.<...<.<.<...&.Z.<.~.<.<.<.}.......09.....'........UCol.....`#...... ..............D...D...D....'...'...'...'..\/..\/...9...9...9..2irT..@.p..... .........0.8.@.H.P.X.`.h.p.x.}.......0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.............0.8.....0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\sl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8704
                                                                                                                            Entropy (8bit):3.6685940591098785
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:erdySmNSGzV/YlvjfTVuAGIh3NvuSiDnEVlKWbCmjgC6VfSmYy:epy1x0j7H3Mo7KMxMSmYy
                                                                                                                            MD5:8C4F7B3BC899D6D6792994EA761879D4
                                                                                                                            SHA1:06982E8B604F9C4435A8F228124AE576ED53A886
                                                                                                                            SHA-256:80313AFB3F4ACA7CA9AA2BF8B4071520845CCE9E3FAA4CA29F0990A0C5D4DE51
                                                                                                                            SHA-512:AA1AAE5287BD1C655F6AB0B3F429A05794EAC5E05617FD0A738CEAEDE3B7960519703D571C513F3BB257FFB2A3C46CD41504A156C31E300514DDFCAA43573850
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................t.. ........x...x...........0...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...&.C.<...<.<.<...<...<.<.<...&.D.<...<.<.<...&.S.<.a.<.<.<.`.&.Z.<.~.<.<.<.}.................. .....'........UCol.....`#...... ..............D...D...D.................................... ..2irT..@.................0.8.@.H.P.X.Y.a.0.8.0.8.i.q.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0.....0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\smn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24540
                                                                                                                            Entropy (8bit):3.7529323885518333
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:YOzfSj10u+D9i4qvs0bDb1riYcEhcXh/hDN10PWyiYcEhc6lxR:fzfSjmPT0DHTcEhwh/ZNmrcEhRHR
                                                                                                                            MD5:B9F397A964EC7B60E93102E703697ACA
                                                                                                                            SHA1:51D9C91C9B6DA8964EEFFC724DBD2E1BBAA55558
                                                                                                                            SHA-256:5B81A62F482B07E2D06BFAD578D6E4806FBCA20E8EC4E6EC271128CE0DA63704
                                                                                                                            SHA-512:BC67CDB81FC32BF35243DEA589E285639BDE5D09A6B60021491927D1BD6342228FE23ADCD263E8E4A915A765436790CEED6FD3879FCC258CF1D4A5DC3FEB2287
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................n...Version.collations.search.Sequence.%%CollationBin.standard....3.5...2...1...1.9...1.4...2.[.i.m.p.o.r.t. .u.n.d.-.u.-.c.o.-.s.e.a.r.c.h.].[.i.m.p.o.r.t. .s.m.n.-.u.-.c.o.-.s.t.a.n.d.a.r.d.]...i.&.A.<...<.<.<...<.<...<.<.<...&.C.<...<.<.<...&.D.<...<.<.<...&.J.<.<...<.<.<...<.<.D.<.<.<.C.&.S.<.a.<.<.<.`.&.Z.<.~.<.<.<.}.<...<.<.<...<...<.<.<...<...<.<.<...<...<.<.<...<...<.<.<...<...<.<.<...<...<.<.<............1.....'........UCol.....`#.......... ..............D...D...D....'...'...(...(..p-..p-...1...1...1..2irT..@.k..... .........0.8.@.H.P.X.`.h.p.x.y.......0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.............0.8.....0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.....0.0.0...0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0...0.....0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\sr_BA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):2.828613311907312
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtl6/NlXelbONglSU5YMnPn:SBtkJK/6v/5YMPn
                                                                                                                            MD5:B6AB05CAEC5B3D87BA18BCA933CC0A26
                                                                                                                            SHA1:42A993B80A17D3F3C7983F1282E1E1FECE63FDED
                                                                                                                            SHA-256:4D8B1CFE45A1B3F9DDD60DAD3AB6D8DFE5F7D328C11B7BB8077A8ECAC46D88CA
                                                                                                                            SHA-512:039741CC2F608D9D33055B9995D0B25E998371EC28317C496749A56C354210FE166F15255BA836E4B93F6B0C5F6A47F9822CBF99515E823B2F82DD8C50A11A3A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...s.r._.C.y.r.l._.B.A..... .....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\sr_Cyrl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.1584082049584112
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDtM86E/lWlRKOt:SBtkJztt6siRKa
                                                                                                                            MD5:446A3139B2628B0370B88DEDED4D5382
                                                                                                                            SHA1:73A290ECC02BE29B6E9DEDD1DDE7B0633CB5D5A8
                                                                                                                            SHA-256:5107405E84E52F18E47AA7071F183E499A2C325E6E4BDA7FCA2B59ECB55D81D7
                                                                                                                            SHA-512:6E6CBE46747664442464BCCB8DC93DFAD4A786C6AC390EDA705C083498C898FF0D9083AFA411E800F1DFC1DB10799BEE110E7C5371B3F559A806D72D42CDEB0C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................___..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\sr_Cyrl_BA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.1584082049584112
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDtM86E/lWlRKOt:SBtkJztt6siRKa
                                                                                                                            MD5:446A3139B2628B0370B88DEDED4D5382
                                                                                                                            SHA1:73A290ECC02BE29B6E9DEDD1DDE7B0633CB5D5A8
                                                                                                                            SHA-256:5107405E84E52F18E47AA7071F183E499A2C325E6E4BDA7FCA2B59ECB55D81D7
                                                                                                                            SHA-512:6E6CBE46747664442464BCCB8DC93DFAD4A786C6AC390EDA705C083498C898FF0D9083AFA411E800F1DFC1DB10799BEE110E7C5371B3F559A806D72D42CDEB0C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................___..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\sr_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20064
                                                                                                                            Entropy (8bit):3.745828754746045
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:TOSfg3SyPv1w0bDbq5KAn8nrRWj3MUKPVV6R:6SYF1vH+CR4Z0jE
                                                                                                                            MD5:A822B9C75FE11AF54909B142EC7C7AE1
                                                                                                                            SHA1:0E1FFDC7BB343BF182036A3AA02B4AFAEFB902EF
                                                                                                                            SHA-256:63B27E0DECE4C56B46B01B940EE40DFC70F24ED16549965AD39CB5D5D4647CEB
                                                                                                                            SHA-512:715B87CDADE594BDCA171DFAD663131AA9AD1B1244DD2F8FCE5E4E0D38B379298AF05131A043C789DEA09DABD995443C13D8079B6AA02BC16651AAA148D8198A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................0...Version.collations.search.Sequence.%%CollationBin.standard....3.5...2...1...1.9...1.4...[.i.m.p.o.r.t. .h.r.]...[.i.m.p.o.r.t. .h.r.-.u.-.c.o.-.s.e.a.r.c.h.]................(.....'........UCol.....`#...... ..........q...D...D...D....#...#...#...#...&...&...(...(...(..2irT..@....... .........0.8.@.H.P.X.Y.a.0.8.i.q.s.{.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.z...........0.8.....0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.....0.0.0...0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0...0.....0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0.....0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\sr_Latn_BA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.1584082049584112
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDtM86E/lWlRKOt:SBtkJztt6siRKa
                                                                                                                            MD5:446A3139B2628B0370B88DEDED4D5382
                                                                                                                            SHA1:73A290ECC02BE29B6E9DEDD1DDE7B0633CB5D5A8
                                                                                                                            SHA-256:5107405E84E52F18E47AA7071F183E499A2C325E6E4BDA7FCA2B59ECB55D81D7
                                                                                                                            SHA-512:6E6CBE46747664442464BCCB8DC93DFAD4A786C6AC390EDA705C083498C898FF0D9083AFA411E800F1DFC1DB10799BEE110E7C5371B3F559A806D72D42CDEB0C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................___..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\sr_ME.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):2.8743333840434984
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtl6/NlXelbONglSU5Fg+fEPn:SBtkJK/6v/57On
                                                                                                                            MD5:71B3D464B83631B1E1ECEC35AFCEAD37
                                                                                                                            SHA1:748A87487B0675355DE3DD7D298173C74176E126
                                                                                                                            SHA-256:D1ED65D21F51001F63C40408403A386F2CBE5EE7A61FF98C1F5DA60A2B391469
                                                                                                                            SHA-512:14DBFF86707AB747C9B93C03AFAC82D744444DEDBF379F5353D769EABF2C05A968FCDB14EBE7AB6531B2C87EFE021DFF051AAD7FCB30CEE50F7173890B8E22B8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...s.r._.C.y.r.l._.M.E..... .....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\yo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9180
                                                                                                                            Entropy (8bit):3.6887838997318045
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:RcVJVehSGzmUWiUoaT3AGIhoyye0XnvIlTjN4T084Tm3Arg3Y1Zo:RcVJYhWiUHmPgIlTjNYFmyb3Yw
                                                                                                                            MD5:5CE536C02CCCE5413DFE8BC4BDC50FD9
                                                                                                                            SHA1:91974FFAB77E59F413F39B9066D5063A0FD6C9B8
                                                                                                                            SHA-256:E9051598553443F4D3B3AB25526A429B38D586ABF7834F28CC820F9CBD60CB1E
                                                                                                                            SHA-512:264C4428FBC70CCA1E0C7E8D09711C05B3C14E22CB664B58C40BAE6F5A866085BDE164B14CD84439428AA334B2C8F3ABA59FDCEA665303E3BCA92B6429ACF79A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................:...Version.collations.standard.Sequence.%%CollationBin...3.5...2...1...1.9...1.4...9.[.n.o.r.m.a.l.i.z.a.t.i.o.n. .o.n.].&.E.<...<.<.<...&.G.<.g.b.<.<.<.G.b.<.<.<.G.B.&.O.<...<.<.<...&.S.<.c.<.<.<.b..........".....'........UCol.....`#...... ..............D...D...D...T...T...T...T...`...`...~........"..2irT..@.................0.8.@.H.P.X.Y.a.a.i.j.r.u.}.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0...0.......0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\yue_Hans.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):96
                                                                                                                            Entropy (8bit):2.732558048486656
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlR/Pllvlsltloe1zRslklk:SBtkJJelXoeZukC
                                                                                                                            MD5:12DD8C36CF20B5221FED4CA8D148690E
                                                                                                                            SHA1:49FE57BD75E718FD72D81117BDEE5C4C0BF187D8
                                                                                                                            SHA-256:BC0C6C650104EE38A032AAB0BD27D3627087549D811BC2AC1090FC675EDD1426
                                                                                                                            SHA-512:74EF0DA76CD1054F3B73EF05AC00991F6425DB064A3803E2E16C2715729CAE32B059D97DAED98C3A0FADB797FAEF30E8520D6335AD41A33B0B1EFFFB6D616035
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...z.h._.H.a.n.s..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zh_CN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):2.893564153274268
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtl6/NlXelbH1zRzlI/kMPn:SBtkJK/67ZFGkOn
                                                                                                                            MD5:D0F44C066DB6528A0F5B74BFBDFA2817
                                                                                                                            SHA1:5FB5162923AD2141AA9687E05D4F4CB79993D33C
                                                                                                                            SHA-256:453BFD4562DF872966F9EEE757B4F470A86740EF9F59C5618C526CA12A29EA6D
                                                                                                                            SHA-512:7530901AF4F8BB5BCD7DAB693C48246FF972B0542561727F38A427522255BFB78A872BBEE35F82D8FCF9322AA25BC6D9C6C861E4679CCB40CC44DC167FD37399
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...z.h._.H.a.n.s._.C.N..... .....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zh_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):2.893564153274269
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtl6/NlXelbH1zRfFPn:SBtkJK/67Zp1n
                                                                                                                            MD5:215ADB705DE3ABA0C31A481B0566E6E6
                                                                                                                            SHA1:412A1B4BDCD5038F986B3FEF3ABE047BF02987D1
                                                                                                                            SHA-256:088EDA99EE757C50C1DBA8520B71914B6084EC5A0FAE9B7FA54D692C420CC967
                                                                                                                            SHA-512:CAF08E7EC4C3EBC249666E901419B90762742C7C7492B7437B15FF64BD9126DCCB3035787E7ED86143B89ACF4BD9936220267ACA57D9DB040055B58983795D30
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...z.h._.H.a.n.t._.H.K..... .....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zh_Hant.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):152
                                                                                                                            Entropy (8bit):3.4689779176628415
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlHF26HfHlsuRmMD4VlliufDUlnBlHlPFPtH:SBtkJ4pMfSlkuwlBlHl/
                                                                                                                            MD5:FED6013D3E13618D243805553B6BFEE8
                                                                                                                            SHA1:CE436DE298C460153DB8C4D009FED9B6C28B9EDE
                                                                                                                            SHA-256:0CC444B8CBCD3DB0702FE798BFF4DB5A56FAE99C8A3576C0025E8B6B57C7C7CC
                                                                                                                            SHA-512:57D313A6A031567C231EBCB2E311CADD7EE7A4854E554651FA34C4B1DFD126AC4544140BDF2512A74F2C22C5EBFC0ADD8524D5B796B27C70DB095A1D2265C471
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................Version.collations.default....s.t.r.o.k.e...2...1...1.9...1.4.....3....... .(......`...P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zh_Hant_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.1584082049584112
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDtM86E/lWlRKOt:SBtkJztt6siRKa
                                                                                                                            MD5:446A3139B2628B0370B88DEDED4D5382
                                                                                                                            SHA1:73A290ECC02BE29B6E9DEDD1DDE7B0633CB5D5A8
                                                                                                                            SHA-256:5107405E84E52F18E47AA7071F183E499A2C325E6E4BDA7FCA2B59ECB55D81D7
                                                                                                                            SHA-512:6E6CBE46747664442464BCCB8DC93DFAD4A786C6AC390EDA705C083498C898FF0D9083AFA411E800F1DFC1DB10799BEE110E7C5371B3F559A806D72D42CDEB0C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................___..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zh_Hant_MO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.1584082049584112
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDtM86E/lWlRKOt:SBtkJztt6siRKa
                                                                                                                            MD5:446A3139B2628B0370B88DEDED4D5382
                                                                                                                            SHA1:73A290ECC02BE29B6E9DEDD1DDE7B0633CB5D5A8
                                                                                                                            SHA-256:5107405E84E52F18E47AA7071F183E499A2C325E6E4BDA7FCA2B59ECB55D81D7
                                                                                                                            SHA-512:6E6CBE46747664442464BCCB8DC93DFAD4A786C6AC390EDA705C083498C898FF0D9083AFA411E800F1DFC1DB10799BEE110E7C5371B3F559A806D72D42CDEB0C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................___..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zh_Hant_TW.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.1584082049584112
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDtM86E/lWlRKOt:SBtkJztt6siRKa
                                                                                                                            MD5:446A3139B2628B0370B88DEDED4D5382
                                                                                                                            SHA1:73A290ECC02BE29B6E9DEDD1DDE7B0633CB5D5A8
                                                                                                                            SHA-256:5107405E84E52F18E47AA7071F183E499A2C325E6E4BDA7FCA2B59ECB55D81D7
                                                                                                                            SHA-512:6E6CBE46747664442464BCCB8DC93DFAD4A786C6AC390EDA705C083498C898FF0D9083AFA411E800F1DFC1DB10799BEE110E7C5371B3F559A806D72D42CDEB0C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................___..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zh_SG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):2.8743333840434984
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtl6/NlXelbH1zRzlhWfEPn:SBtkJK/67ZFLWOn
                                                                                                                            MD5:62CA9648BCF3E92915DF4ED667775BB3
                                                                                                                            SHA1:80DADE2F7AE52289CF346A3B1DE99504E082D4CA
                                                                                                                            SHA-256:918FB146507DF2A02DF8DD79E35A7D9D88BE3338D55D1D2F1E4AFADA8E72278F
                                                                                                                            SHA-512:34BF61355D86566692BDAEC6FE9F748B23091E7F8E9FFC05C49398A0D35775A6438DD23E58D382A4ED3A2A3F37CB3A6120885100448052B76E28CB625E2C57AF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...z.h._.H.a.n.s._.S.G..... .....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\coll\zu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.7234597887964593
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlu12Ol/8klclsX+RZlUlnBlk:SBtkJK2Ol/8sU2cwlBlk
                                                                                                                            MD5:74852472ABC6DD63B12C4766472C9B74
                                                                                                                            SHA1:5B59504CCCC2A557A39AB15BFFAC0270D4E4014A
                                                                                                                            SHA-256:BD31F37629AFE5B5CA7801F26F251980F6F6A737C01C3C5BE19E10B8F4840F00
                                                                                                                            SHA-512:80E3F257A80030BECD995377E912BCB62940C2819CEE559441CD3B9A141229A7E071FA75B91B4B868DCDBFD00AC389F5250C7D49D0F8096E8CDF9B045523D0DB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................Version...2...1...1.9...1.4..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\cs.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25332
                                                                                                                            Entropy (8bit):6.150166074843294
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:i+zx2Zn+k/sR5mfiiiTw5ePOVPIFPDeikGgq0QPh+PE+PByPilNlolXWPC1xEuMf:d2Ek/cvgi7LGXKize2zu9Hq
                                                                                                                            MD5:6C0B6516861C11A0347E8CE5B4E7984C
                                                                                                                            SHA1:DC8B41A155C2B0F7EC068EE9B43D1481F78CF312
                                                                                                                            SHA-256:CCCD7FF2B6D8A3CEAF93E36FA1D87EF94E4648E68DC8EC1BC94B08B9FAFB13AF
                                                                                                                            SHA-512:3A37B6A98C434140CCA35A0F78B653875C1B03061B23477B5C561B66D04CA6CE1B5966A6193DEC999C7F1EEA041DF562BD5A58474EF31ACEF8235813D7DB0AEA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................V.......K............p.......t.....t...d.e.i...t...r...H.a.d...K.o.H...P.e.s...h.a.d...k.o.H...p.e.s...b.Y.e...d.u.b...k.v.....l.e.d...p.r.o...s.r.p...z...Y.....n.o.....v.c.....v.n...Y...j...a.a.....U.S.A...o.d.p.....i.j.a.r...m...g.h...p.a.u.a...r...n.o.....b...n.....z.a.r...D.r.a.k...K.o.z.a...T.y.g.r...V.e.p.Y...d.n.e.s...d.r.a.k...k.o.z.a...n.y.n.....p.o.l.....t.y.g.r...v.e.p.Y...`.a.k.a...p.o.l.....r.e.d.....z...Y.....a.a.w.....j.i.n.....l.e.t.....m.u.~.i...t...l.o...v. .n.......n.o.r...~.e.n.y...h.i.d.a.r...t.o.u.b.a.....a...d.h...a.e.v.a.t...B.u.v.o.l...K.r.y.s.a...O.p.i.c.e...Z.a.j...c...b.u.v.o.l...k.r.y.s.a...o.p.i.c.e...v...e.r.a...z.a.j...c...z...t.r.a...d.u.b.e.n...d.u.b.n.a...h.a.n...a...l.e.d.e.n...l.e.d.n.a...p.o.l.n.....r.o.z.n.....s.r.d.c.e...s.r.p.e.n...s.r.p.n.a.....n.o.r.a.......s.l.a...Y...j.e.n...Y...j.n.a...a.i.p.k.y...p.o.l.n.o.c...g.i.n.b.o.t...h.a.t.o.u.r...k...r.t.i.k...m.i.y.a.z.a...m.o.r.d...d...p.a.g.u.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\cs_CZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXEl0t6E7lFEKe:SvKM0t6gCKe
                                                                                                                            MD5:CF788FA9793FEA6104E904FBA48B9ADE
                                                                                                                            SHA1:5105A53F269A6C445FE58F0AB7BB501BF5790960
                                                                                                                            SHA-256:D49D36962528CD70E638FE62C2A675838D5F6D13C229F6A107530D58C458D100
                                                                                                                            SHA-512:B07CED3B04E2CE33B0FA215AE03002E666D5408F31ADE8FE84F46E2A7474D277B40887F090D5DB6ABEA58B6A8DF385F952DD614979AD903AAF31B524A06AA93B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\af.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10140
                                                                                                                            Entropy (8bit):4.947208245996127
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:18bx6XHZhLlIwU3IOHTOJWlWWq3cbf0bZx8tD5ZC+UB3UOxNOnC1/cM:axc/LlI5tT7WWq3cL00J5M+UB35WnpM
                                                                                                                            MD5:64607A2EF6187866EE2A718A10331921
                                                                                                                            SHA1:2F5B24C41D5A5C624F625F0AF7B10CF04F551AB6
                                                                                                                            SHA-256:CD8A8550E2FBDFD484754E563C9F3138CA61235FC9459F31863AA4FB4390242F
                                                                                                                            SHA-512:CF5DC7F9344C2F7540AD4415CC13C7C1E9B6E4445F78ECE7A766D3E8B1FF39229A32C86D5633F78AEAEA9AA7F33D0F238E75FD5808151B0B015B7498B2A9E41A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .&....................H......i~...B.r.i.t.s.e. .p.o.n.d...I.r.a.n.s.e. .r.i.a.l...T.u.r.k.s.e. .l.i.e.r...I.r.a.k.s.e. .d.i.n.a.r...S.i.r.i.e.s.e. .p.o.n.d...J.a.p.a.n.n.e.s.e. .j.e.n...K.a.z.a.k.s.e. .t.e.n.g.e...K.u.b.a.a.n.s.e. .p.e.s.o...L.e.b.a.n.e.s.e. .p.o.n.d...L.i.b.i.e.s.e. .d.i.n.a.r...L.i.t.a.u.s.e. .l.i.t.a.s...M.i.a.n.m.e.s.e. .k.y.a.t...S.w.e.e.d.s.e. .k.r.o.o.n...I.n.d.i.e.s.e. .r.u.p.e.e...C.h.i.n.e.s.e. .j.o.e.a.n...L.e.t.t.i.e.s.e. .l.a.t.s...D.j.i.b.o.e.t.i. .f.r.a.n.k...E.g.i.p.t.i.e.s.e. .p.o.n.d...E.t.i.o.p.i.e.s.e. .b.i.r.r...G.e.o.r.g.i.e.s.e. .l.a.r.i...K.i.r.g.i.s.i.e.s.e. .s.o.m...K.r.o.a.t.i.e.s.e. .k.u.n.a...L.a.o.s.i.a.a.n.s.e. .k.i.p...M.a.c.a.o.s.e. .p.a.t.a.c.a...M.o.l.d.o.w.i.e.s.e. .l.e.u...O.e.z.b.e.k.i.e.s.e. .s.o.m...S.e.r.b.i.e.s.e. .d.i.n.a.r...V.a.n.u.a.t.u.s.e. .v.a.t.u...Y.s.l.a.n.d.s.e. .k.r.o.o.n...I.n.d.i.e.s.e. .r.o.e.p.e.e...K.a.t.a.r.r.e.s.e. .r.i.a.l...A.f.g.a.a.n.s.e. .a.f.g.a.n.i...A.l.g.e.r.i.e.s.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\af_NA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.315821515325992
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQx68tXmar98k+FlllQ/wF:Svu68dmar9il4wF
                                                                                                                            MD5:006F2DC31EBA19D58A2D90952FC0A0E1
                                                                                                                            SHA1:345751FC3EA8C1F78EABBEEE3D8F35DB6B2703BD
                                                                                                                            SHA-256:B58B655CF2787743987BB1CAA66DCBD5F75C1161FAF18F426DD82983E57E8CE6
                                                                                                                            SHA-512:6D94175559DF549A22428E21111C347ABD77E75B7FB2A5DACD653E2C5C73D9EBCDE74B000E284E76BEE135DD5A1D90B5B14AD3FA0DD82AB1E1CD3BAABB260845
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .!....................!......i~....... .................... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ak.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2308
                                                                                                                            Entropy (8bit):4.3979767036908575
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:wpUIdMjJNuPVJyVFSq3urfDM69UW52wZGY929bJMh1X7/mY/F2nrMyQpnvg:8WK7yVFvuXZ9352bY9291O1X7/mY/Qwq
                                                                                                                            MD5:55FE1F0AEEB53BCBA85349A099DEE4BA
                                                                                                                            SHA1:0AA381447584402F3B07BC0C890553B4D3D03D29
                                                                                                                            SHA-256:54C82B3FAE82F1A28DB85C85C9D6B28549E2EB26BCBC5C4904E717D189CE8A70
                                                                                                                            SHA-512:430BD7047BB642689D6F6224C30D7636D7E801678D611D668E72C4FEFED8F09FD4747412A0E059BFC1FBC976495E3DDDC8597201431C9B0425EFE0C2C820F72C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................5.. ..#.....9...9...9............i~...I.r.o...S.e.f.a.....s.k.u.d.o...E.g.y.p.t. .P.T.n...S.u.d.a.n. .P.T.n...B.a.r.e.n. .D.i.n.a...B.r.e.t.e.n. .P.T.n...G.h.a.n.a. .S.i.d.i...G.i.n.i. .F.r.a.n.k...G.y.a.p.a.n. .Y.[.n...I.n.d.i.a. .R.u.p.i...L.i.b.y.a. .D.i.n.a...S.u.d.a.n. .D.i.n.a...I.t.i.o.p.i.a. .B.i.r...K.a.n.a.d.a. .D.T.l.a...K.o.n.g.o. .F.r.a.n.k...L.e.s.o.t.o. .L.o.t.i...A.m.[.r.i.k.a. .D.T.l.a...K.e.n.y.a. .H.y.e.l.e.n...K.o.m.o.r.o. .F.r.a.n.k...M.o.r.o.k.o. .D.i.r.a.m...N.a.m.i.b.i.a. .D.T.l.a...T.u.n.i.s.i.a. .D.i.n.a...A.n.g.o.l.a. .K.w.a.n.z.a...B.u.r.u.n.d.i. .F.r.a.n.k...G.y.e.b.u.t.i. .F.r.a.n.k...L.a.e.b.e.r.i.a. .D.T.l.a...M.a.l.a.w.i. .K.w.a.c.h.a...R.e.w.a.n.d.a. .F.r.a.n.k...S.e.y.h.y.[.l.s. .R.u.p.i...S.t. .H.e.l.e.n.a. .P.T.n...U.g.a.n.d.a. .H.y.e.l.e.n...Z.a.m.b.i.a. .K.w.a.c.h.a...Z.i.m.b.a.b.w.e. .D.T.l.a.....l.g.y.e.r.i.a. .D.i.n.a.....s.t.r.e.l.i.a. .D.T.l.a...M.a.d.a.g.a.s.i. .F.r.a.n.k...M.T.r.e.h.y.e.T.s. .R.u.p.i...N.a.e.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ar_SO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.312176235559989
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQgC8tsllxr94jfllQ/kF:SvnC8C/xr94f4kF
                                                                                                                            MD5:079D7976EA62316FB2E3C13E2773ADF1
                                                                                                                            SHA1:ED428FC821C21CF338AC7E89BF4C84CA65141ABD
                                                                                                                            SHA-256:702F9725F0A7266A0C9AEA585BB4F5C2D47C60914E684F236F29702977B54F32
                                                                                                                            SHA-512:BDF76350E4931D8E4788A73DBD1E890525150C23BF6981EADF4603B2635D7AE33647D54B3FB58B7FEBE2ED5CA812652B6FB3398F2E544F12FD1AA227B869FC20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .p....................p......i~.......o...#................ ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ars.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.706321389987818
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlKelBjlgljl/deNl6l2lkWx:SBtkJTl4P06s+Wx
                                                                                                                            MD5:684C1B6BFD753BA822EA8D74E056CB7C
                                                                                                                            SHA1:54554C5264F3AA4A913FE41EC70C78AE092E9725
                                                                                                                            SHA-256:DD2EC488EAAFDA87F276CF164B7D82BD2CC85B4C1945630C2A42B91EFD5DA63E
                                                                                                                            SHA-512:F9A62E62E630D08D847F81FE32E6A7C9B07938B886F85A838C9549A8DBCA3A773E1968840BCF2B7016ED35BA9AA54F0F3602F4879F05741813E8E62FE44F2A2E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...a.r._.S.A.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\as.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10528
                                                                                                                            Entropy (8bit):5.22841261707209
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:9zBra2qxqD6/IxqGSBixWCpNRhGue6xl/WhjN402thEjTZZKj6muLAO0WP1Pobji:JBrw/IHV8PAQCvxzKJY9DH6lqsqGVJ
                                                                                                                            MD5:25E937A70C85521D2EB2B81F5285BA5A
                                                                                                                            SHA1:A02AEF71EFF198FC3069EA3107703E0BB3486ECF
                                                                                                                            SHA-256:C9BA27BCCE9814AB188A5EFAF429E3A2D1BB899148E474A6DE92DCC0E4EBB000
                                                                                                                            SHA-512:7872318C367F434E3788AEBC29375AA6174167726F4A5F2E3CE1C1AECE2B952453E806DB9479623911F5D40B5A8052EFDCEF59CC5EFE92A4A309EE2E3C38865E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................9.. ........@...@.........K.-....i~................... .........C.F.P. ......................... ................... ................... ......................... ............... ..... ...........U.A.E. ......................... ..................... ........................... ................... ....................... ....................... ........................... ..................... ......................... ..................... ............................... ............... ....... ..................... ............................. ......................... ..................... ............................. .............. ...... ............................. ......................... ......................... ........................... ......................... ......................... ..................... ............................. ............................. ........................... ....................... ...................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\asa.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2496
                                                                                                                            Entropy (8bit):4.225674105997367
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:xs2uGj+skXWtT/bS2sr61LDVlHAcirEKr2kfJKp/CgV+:x/uY+sKW/u2JnlgFom0p/9V+
                                                                                                                            MD5:05572B51CDD83FD3D81BB148ACB07220
                                                                                                                            SHA1:A259AC53240764086743A0CEF9B0582E24E5DE68
                                                                                                                            SHA-256:A8F2E53E5F27A01C1A4C230ADF2628FAAE1D755331A655D07245BBD82ABD115A
                                                                                                                            SHA-512:4F4ECBB6B074BAED7ED5C485F0B46C5F34D11125658A3CC9D660F477EE498D5069AD3B40A893128F6B5C9619DCDC95AC8A973E6DBA216839DDC430CFCCF6DC08
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................d.. ........h...h...:............i~...t.h.e.d.i. .y.a. .G.h.a.n.a...b.i.r. .y.a. .U.h.a.b.e.s.h.i...f.a.r.a.n.g.a. .y.a. .G.i.n.e...l.o.t.i. .y.a. .L.e.t.h.o.t.o...p.a.u.n.i. .y.a. .M.i.t.h.r.i...d.i.r.h.a.m. .y.a. .M.o.r.o.k.o...f.a.r.a.n.g.a. .C.F.A. .B.E.A.C...n.a.i.r.a. .y.a. .N.i.j.e.r.i.a...p.a.u.n.i. .y.a. .T.h.u.d.a.n.i...r.i.y.a.l. .y.a. .T.h.a.u.d.i.a...r.u.p.i.a. .y.a. .M.o.r.i.t.h.i...d.a.l.a.t.h.i. .y.a. .G.a.m.b.i.a...d.i.n.a.r.i. .y.a. .A.l.j.e.r.i.a...d.i.n.a.r.i. .y.a. .T.h.u.d.a.n.i...d.o.l.a. .y.a. .D.h.i.m.b.a.b.w.e...f.a.r.a.n.g.a. .C.F.A. .B.C.E.A.O...f.a.r.a.n.g.a. .y.a. .B.u.k.i.n.i...f.a.r.a.n.g.a. .y.a. .J.i.b.u.t.i...f.a.r.a.n.g.a. .y.a. .K.o.m.o.r.o...k.w.a.c.h.a. .y.a. .D.h.a.m.b.i.a...k.w.a.n.d.h.a. .y.a. .A.n.g.o.l.a...p.u.l.a. .y.a. .B.o.t.t.h.w.a.n.a...d.i.n.a.r.i. .y.a. .B.a.h.a.r.e.n.i...d.i.n.a.r.i. .y.a. .T.u.n.i.t.h.i.a...d.o.l.a. .y.a. .A.u.t.h.t.r.a.l.i.a...e.t.h.k.u.d.o. .y.a. .K.e.p.u.v.e.d.e...f.a.r.a.n.g.a. .y.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\bas.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2376
                                                                                                                            Entropy (8bit):4.511785904113108
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:3SZaekjjUm6NGNEXXlDZVY1/xyJORNEkhxydxSfQIq8TgVz5nnv:3S1SjUm6wg19VY15YObvXsU8zVFv
                                                                                                                            MD5:D8683BE4C956E7903417885139455F6D
                                                                                                                            SHA1:81E74E1FF50403380D3C7BCEB7D6C99152923C7C
                                                                                                                            SHA-256:0E9B8915A5A6B9FDA23CE479A5D454A4F80C6B21F6CCE6D37A4223ADEA3377C0
                                                                                                                            SHA-512:5D8F493E589E0B07A0BD9C13DD1EDC75CCE53C5A2E4CF1AF87B12A3522BC105E19D608EB739248FE0F79BCFA610F389313663B9F195FFBF8EB9A70CCCC88FCE8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................F.. ........J...J...:............i~.....r.....L...o.n.[.....F.r...K. .g...n.....S...d.i. .g...n.....Y...a.n. .k.i.n.....F.r...K. .k...K.g.o...F.r...K. .s...w...s...R...a.l. .s...u.d.....R...p.i. .+.n.d.......Y.[...n. .y...p...n...B...r. ...t...o.p.......D...n...r. .l.i.b.......D...n...r. .s...d...n...D...n...r. .t...n...s...D.T.l.a. ...m.e.r.k.....F.r...K. .R...a.n.d.....F.r...K. .j...b.u.t.....F.r...K. .k...m.o.r.....L.o.t... .l...s...t.....P.a...n.d. .s...d...n...S.i.l...K. .k.e.n.......D.i.n...r. .B...r.a...n...D.i.r.h...m. ...m...r.....D...r.h.a.m. .m...r...k...F.r...K. .b...r.u.n.d.....K.w.a.c.a. .m...l.a.w.....K.w...c.a. .s...m.b.i.....P.a...n.d. .h...l.e.n.....P.a...n.d. ...g...p.t.....R.u.p...[... .m...r...s...S.i.l...K. .s...m...l.i...S.i.l...K. ...g...n.d.....D.a.l.a.s... .g.a.m.b.......D.o.b.r... .s...o.t...m.e...D...n...r. ...l.g.e.r.......D.T...l...r. .k...n.a.d.....F.r...K. .m...l...g.a.s.....K.w...n.z.a. ...K.g.o.l.....N.a.f.k... ...r...t.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\be.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):29460
                                                                                                                            Entropy (8bit):4.485162904696295
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:6GE+P67DqsdHTXvIubR9VL4SrX72/rrq9WALkXk7OQbYUjkjFdPbZ:k7DqsaulLkXWkf
                                                                                                                            MD5:ACA178D3F7923220CE3F676284A58FE3
                                                                                                                            SHA1:0BEFF3E73D3C05ED14259C5F7051237EFB1FEE74
                                                                                                                            SHA-256:F48DC1EB0C4D9FEA72460090149A80F9273B2B473FD2642ED0F05D3D1E5F2909
                                                                                                                            SHA-512:DC29ED80EDE0E810B4491674E6298DB0948F4DBCB9941ED963166CDAB31E896C86CB942C5CBCB0099F8CC5D176A456D94C53101BC91D0399480C625769F3EC65
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...........................i~...$.U...B.$...G.$...L.$...N.$...$.M.N...B.D.$...C.I.$...F.K.....S.I.$...5.^.@.0...:.V.=.0...@.C.1.....;.5.>.=.M...1.0.;.V.2.V.O.=.0...4.>.;.0.@. ...(.....4.K.@.E.5.<. .....-...;.0.>.A.:.V. .:.V.?...B.0.9.A.:.V. .1.0.B...4.>.;.0.@.0. ...(.....4.>.;.0.@.K. ...(.....4.0.F.:.V.E. .:.@.>.=...4.>.;.0.@.0.^. ...(.....4.K.@.E.5.<.0. .....-...4.K.@.E.5.<.K. .....-...?.0.B.0.:. ...0.:.0.0...0.;.1.0.=.A.:.V. .;.5.:...0.<.0.=.A.:.V. .@.K.0.;...3.0.=.A.:.V. .A.5.4.7.V...4.0.F.:.0.O. .:.@.>.=.0...5.<.5.=.A.:.V. .@.K.0.;...?.0.B.0.:.0. ...0.:.0.0...?.0.B.0.:.V. ...0.:.0.0...@.C.<.K.=.A.:.V. .;.5.9...C.7.1.5.:.A.:.V. .A.C.<...M.D.V.>.?.A.:.V. .1.K.@...V.@.0.=.A.:.V. .@.K.0.;...4.0.F.:.0.9. .:.@.>.=.K...4.0.F.:.V.O. .:.@.>.=.K...4.K.@.E.5.<.0.^. .....-...;.0.>.A.:.V.O. .:.V.?.K...B.0.9.A.:.V.O. .1.0.B.K...B.C.@.M.F.:.V.E. .;.V.@...G.M.H.A.:.V.E. .:.@.>.=...O.?.>.=.A.:.V.E. .V.5.=...0.@.<.O.=.A.:.V. .4.@.0.<...1.0.;.3.0.@.A.:.V. .;.5.^.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\bg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):32436
                                                                                                                            Entropy (8bit):4.645809034718554
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:vrGVznQRVUXi7gFMn01ftm7OIFhq2vTFy4Y07D1DE:vKZQRVUXi7gX1f7AhVs4Y0nlE
                                                                                                                            MD5:4F869609848B4ABC169C4CBF13BB6D97
                                                                                                                            SHA1:3CDD250564CC3627406F57C54D64F8FF7171AF6E
                                                                                                                            SHA-256:CB1C3858BE09F9F2251A880B8C23A01A27A8B4B66CE97DE6CFC9EE8C9D75D8E7
                                                                                                                            SHA-512:01939190DD74228817347C25098C8AB9413DDFA0D4E2B8BB006ADB46064B486D7EF7FF34B10B03BEEAB72E6C608E6C41CF09898DF9653B251977D142528EC541
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..b..........................i~...;.2.....I...4.......0.;.0.4.8.9.....:.C. .=.0. .........;.0.>.A.:.8. .:.8.?... .C.A.:.0. .@.C.1.;.0...'.5.H.:.0. .:.@.>.=.0...;.0.>.A.:.8. .:.8.?.0...B.C.@.A.:.8. .;.8.@.8...G.5.H.:.0. .:.@.>.=.0...G.5.H.:.8. .:.@.>.=.8.....0.B.A.:.0. .:.@.>.=.0.....8.B.0.9.A.:.8. .N.0.=... .C.<.J.=.A.:.0. .;.5.O...#.7.1.5.:.A.:.8. .A.C.<...).0.B.A.:.8. .4.>.;.0.@.../.?.>.=.A.:.0. .9.5.=.0...4.0.B.A.:.0. .:.@.>.=.0...4.0.B.A.:.8. .:.@.>.=.8...8.@.0.=.A.:.8. .@.8.0.;...:.8.B.0.9.A.:.8. .N.0.=...>.<.0.=.A.:.8. .@.8.0.;...?.>.;.A.:.0. .7.;.>.B.0...?.>.;.A.:.8. .7.;.>.B.8...C.7.1.5.:.A.:.8. .A.C.<...E.0.8.B.A.:.8. .3.C.@.4...I.0.B.A.:.8. .4.>.;.0.@...O.?.>.=.A.:.0. .9.5.=.0...O.?.>.=.A.:.8. .9.5.=.8.....@.<.5.=.A.:.8. .4.@.0.<.....J.;.3.0.@.A.:.8. .;.5.2.....0.=.0.9.A.:.>. .A.5.4.8.....0.O.=.A.:.8. .4.>.;.0.@.....@.J.F.:.0. .4.@.0.E.<.0.....0.8.@.A.:.>. .7.0.9.@.5.....@.0.:.A.:.8. .4.8.=.0.@.....5.<.5.=.A.:.8. .@.8.0.;.....8.?.J.@.A.:.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\bo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):264
                                                                                                                            Entropy (8bit):4.197496566468057
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvYofrb9llflNDsVMiDVw9qwD/XRH4kgAShkzqgMg:lMrlf3DsSiDVwvTBKAeYq7g
                                                                                                                            MD5:91B95B3F641DB68B2EA5064F00CB94CD
                                                                                                                            SHA1:4064F6DC451F380A5BB2C4A9C3E40F36334A06CF
                                                                                                                            SHA-256:2E051BF296334CE9A0AD71A283FA450A631DFAEB21A788AE51DE568EF5F7BC4F
                                                                                                                            SHA-512:742EDECC6C599E8759C2FF3B0108794AF2E1634EEF4FF8D9CAA124448B56CF857783F8DED591F943F5DAFB1A409F8EDCAE01540C8AECE80AA933A71E4B9473D3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................6.. ........:...:.........../....i~...a.t...h.S.....b.......B.b...f...|.b.....h...b.r.`.r...f...|.b.....X...b...|.B.f...T.`.r...S.t.f...X.z.Q...Q.D.t.c...c.|.b...................................o.....?...B...E...H.........../.. ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\bo_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):116
                                                                                                                            Entropy (8bit):3.517596863677718
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlEFu4g0reqqdquqllnfBiPUiltllvUNClFn:Sv8vxrb9llOPUfmF
                                                                                                                            MD5:9FF87E06F0477ADD9846CB21A6F6D48A
                                                                                                                            SHA1:E30CBBA9C4579206AAA1FD9C49D19B9202ABE9ED
                                                                                                                            SHA-256:FF1D492C6C011BC2638BA171CF8C0894035549966ADD7C448C3BA92BEED3A8C5
                                                                                                                            SHA-512:BEB9D941C0558852EBD6E8A138C4B13951692A7CAE748645A6AF3147DE7990DC58A813F2F9628D04ECF68A7AC02C592967E75EA54A13A020998AB78C12F5EC83
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...a.t...h.S................................ ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\bs_Cyrl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20072
                                                                                                                            Entropy (8bit):5.3992671375665084
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:y7QAvrGONYwEEXYYyyyMFPCJTk6MGy4MWb3knQUSu3y4MYM3U:yQAvrGONnYyEJTk684MWbUn7I4MVU
                                                                                                                            MD5:F7D631020FD45D1CC35CFFA449E96481
                                                                                                                            SHA1:22BE0657F6930B398E59CB8D502E442191041E5D
                                                                                                                            SHA-256:418B1A0D22B60FEBCFBD5CD9ECB0EB6A4995302E5668005D9A0007E646598E3C
                                                                                                                            SHA-512:81F3B7E837BD26BF6744F16C42072B6EC4436CE664FD40A5E75A21C3105D05E0F0A1A4D990DAA945B9841D104D7B10E245473ED80E64EA860675CAA4D662293C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..l...................7.;....i~...........G...".;...7.;...4.8.=.....7.;.0.B.0...7.;.0.B.>...A.@.5.1.@.0...A.@.5.1.@.>...?.;.0.B.8.=.5...".0.8. .1.0.E.B...B.0.8. .1.0.E.B...B.0.8. .1.0.E.B.0...#..... .4.8.@.0.<...#..... .4.8.@.0.<.0...C.F.P. .D.@.0.=.F.8...$.8._.8. .4.>.;.0.@...3.0.=.A.:.8. .F.5.4...D.8._.8. .4.>.;.0.@...D.8._.8. .4.>.;.0.@.0.....0.=.A.:.8. .F.5.4.8...3.0.=.A.:.0. .F.5.4.0...;.0.>.H.:.8. .:.8.?.8.....5.;.8.7.5. .4.>.;.0.@.....>.;.4.>.2.A.:.8. .Y.C... .C.<.C.=.A.:.8. .;.5.C...2.0.=.C.0.B.C. .2.0.B.C...3.0.=.A.:.8.E. .F.5.4.0...:.8.=.5.A.:.0. .X.C.0.=...@.C.<.C.=.A.:.8. .;.5.8...G.5.H.:.8.E. .:.@.C.=.5.....;.1.0.=.A.:.5. .;.5.:.5.....=.4.8.X.A.:.8. . .C.?.8.....C.1.0.=.A.:.8. .?.5.7.>.....5.:.A.8.G.:.8. .?.5.7.>.....5.?.0.;.A.:.8. .@.C.?.8...2.0.=.C.0.B.C. .2.0.B.C.0...2.0.=.C.0.B.C. .2.0.B.C.8...8.@.0.G.:.8. .4.8.=.0.@.8...<.5.:.A.8.G.:.8. .?.5.7.>...<.>.;.4.>.2.A.:.8. .;.5.8...A.@.?.A.:.8. .4.8.=.0.@.8...5.B.8.>.?.8.X.A.:.8. .1.8.@...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\bs_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9159246284584364
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwlut6E7lI/jbr+0mun:Sv/0t6gIjbrlmun
                                                                                                                            MD5:7721B72D6E81A0F713A6D57EBE1A013E
                                                                                                                            SHA1:1FD64BA1FBD011B96B228AD5B67CD376FC57A45A
                                                                                                                            SHA-256:4D177F2F8CC658D164AAFAD84AFBB372B7B70C61D4A0E6437AC3FD510B8C7167
                                                                                                                            SHA-512:F3C3D609AE54033E071A5B79C0916896B651DAD135F0030F0DA6CF1886723A04952A4628E9E0CF3E1B3E4C1FBC691468A565545D8B3310B0938ABC7BB0959B4F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ca_FR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.254334286211548
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ6C8t6/xr9Y/lllQ/kF:Sv48or9Y/l4kF
                                                                                                                            MD5:1B677BA1FFDDEA7E9012D1A6F9F64AAF
                                                                                                                            SHA1:AD152F308C5AC32B880ADD0678AEADF1474B03B1
                                                                                                                            SHA-256:75C44C64718E8ADCF2CD8947E2893396F62251659925D521EE3C1B0180A2CE38
                                                                                                                            SHA-512:D2422E76A21CA4AC6D3844AC51F3C323AC541F9769863ECAD01C029011AA94D7FCA937059836AA6CDAD1E02ECEE7621EFA4FBB4F45E10063BF8FCCBFBE36006A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..1....................1.....i~........1................... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ceb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):804
                                                                                                                            Entropy (8bit):4.276151774117483
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:9VtHbKY8K1t+87cwAeJCKMz28oC/AeXE9lF1EiEoAQg2OrAhLg/yVz2Ol1V:9HurwPxZU/ylO9DAtxVtf
                                                                                                                            MD5:D29930D26FF025E995FF0DFE3446BB53
                                                                                                                            SHA1:2A935AF793B83EB754454657DAA3670CD773185C
                                                                                                                            SHA-256:3B106AA8533E5A35FB91C0C8891C127FE1503D504181E94C3815852641A2CE3E
                                                                                                                            SHA-512:55C4F57F66CFA0DA1F19ADD01B2D9C53136DE4476E6D502BD31CF65669699D2D69E4DD2ACC0F3AEE9D07DDA2634059AD1B38C6F08D77D2D91882E1FED1FF440A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .t....................t......i~...U.S. .$...m.g.a. .e.u.r.o...R.u.s.o.n.g. .r.u.b.l.e...D.o.l.y.a.r. .s.a. .U.S...d.o.l.y.a.r. .s.a. .U.S...H.a.p.o.n. .n.g.a. .y.e.n...H.a.p.o.n. .n.g.a. .Y.e.n...I.n.t.s.i.k. .n.g. .y.u.a.n...R.u.p.e.e. .s.a. .I.n.d.i.a...d.o.l.y.a.r.e.s. .s.a. .U.S...I.n.t.s.i.k. .n.g.a. .Y.u.a.n...M.g.a. .r.u.p.e.e. .s.a. .I.n.d.i.a...I.n.g.l.a.t.e.r.a. .n.g.a. .l.i.b.r.a...I.n.g.l.a.t.e.r.a. .n.g.a. .L.i.b.r.a...................h...\.*...........................u...........W.....o...................................s.z...........................................................................W.........+.....o...............................................W.........+...o......P...P...P...P...P...P...P...P...P............... ...P... ...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\da.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):21588
                                                                                                                            Entropy (8bit):4.913817114459423
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:o9x5StOwB5wgb/gz4cIVJBgDN2JCs7jcbyCIdp1lirywHmH:v08o+W4177Cw0+wq
                                                                                                                            MD5:BA80ED1E570C9C651412B84777A74747
                                                                                                                            SHA1:20598C7CE0B9A6C0A1DEA1C99D62814AA1D33936
                                                                                                                            SHA-256:2D35976B2F18F380691F41C9E5C9D8C7464BF1FB748C401BBBEBE2CDD3C1D31F
                                                                                                                            SHA-512:6B0B9C66A9B7E3A2CB3911F4B765904FAD77D45615877A9BE049375E42BACBE211B9652BA02BF06FB115A94541D3D95197F76F8516882B1A97F8B25D03D1380D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .KQ.........................i~...E.C.U...E.M.U...S.D.R...G.u.l.d...S...l.v...I.r.s.k. .p.u.n.d...T.y.s.k. .m.a.r.k...F.A.E.-.d.i.r.h.a.m...F.i.n.s.k. .m.a.r.k...I.r.s.k.e. .p.u.n.d...T.y.s.k.e. .m.a.r.k...L.e.t.t.i.s.k. .l.a.t...r.u.m...n.s.k. .l.e.u...F.i.n.s.k.e. .m.a.r.k...E.s.t.i.s.k. .k.r.o.o.n...F.r.a.n.s.k. .f.r.a.n.c...M.a.l.i.s.k. .f.r.a.n.c...i.n.d.i.s.k. .r.u.p.e.e...t.y.r.k.i.s.k. .l.i.r.a.....s.t.t.y.s.k. .m.a.r.k...G.r...s.k. .d.r.a.k.m.e...c.u.b.a.n.s.k. .p.e.s.o...r.u.m...n.s.k.e. .l.e.i...B.e.l.g.i.s.k. .f.r.a.n.c...I.s.r.a.e.l.s.k. .p.u.n.d...L.e.t.t.i.s.k. .r.u.b.e.l...m.o.l.d.o.v.i.s.k. .l.e.u...v.a.n.u.a.i.s.k. .v.a.t.u...E.s.t.i.s.k.e. .k.r.o.o.n...G.r...s.k. .d.r.a.k.m.e.r...L.e.t.t.i.s.k.e. .l.a.t.s...M.a.l.i.s.k.e. .f.r.a.n.c...S.p.a.n.s.k. .p.e.s.e.t.a...t.y.r.k.i.s.k.e. .l.i.r.a...u.k.e.n.d.t. .v.a.l.u.t.a.....s.t.t.y.s.k.e. .m.a.r.k...s.c.h.w.e.i.z.e.r.f.r.a.n.c...B.u.r.m.e.s.i.s.k. .k.y.a.t...G.u.i.n.e.a.n.s.k. .s.y.l.i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\de_LI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.309432036254817
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQwl0t8ts/jbr9SIalk/XllQ/kF:SvDut8Sjbr9SIrf4kF
                                                                                                                            MD5:480B302B096BBBE6CD67C93DDC98F945
                                                                                                                            SHA1:5328D6007054F6D0B727DBB886BFD1BB9BD6EA78
                                                                                                                            SHA-256:671A55A822B1D2D1F56D2E86D98EEF4106FE7CC107B42F31E0B5A9163859437B
                                                                                                                            SHA-512:5C26E8352BD63CA0900CD634DD4A3EDB22E66F2DAC8A9B161EA3B9FA890932D9FDF3A581BF7056870C516A9CEBC50958E9FA56AC22F68ED0983D58C678205035
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~.....&.h.................... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\dje.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):824
                                                                                                                            Entropy (8bit):4.816512518857309
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:jLCsLCV+pmdaf7GtwxG9Mg+M/nXHXHCXnE4T:jpLq+rfG9MgVf33CXE4T
                                                                                                                            MD5:DA2FA9DC69B9D0979A67B83B05FFDA67
                                                                                                                            SHA1:1DF72F24492345C85D60517BFDE6510CF609F907
                                                                                                                            SHA-256:3EFF5FFE90F37E814B839016C729F94BAD790BDB1D9D18817BADAEC4DB3407BD
                                                                                                                            SHA-512:7E1FE92C575D2841CAE95AE8F311F8E2861CAE59DBE0525407ECE7BA80A534A0DDE808944ED4E53CF862364B340E326695288EF02E5B0125A5BA8CE3AB862083
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..h.............:.......X....i~........8....`U.....8..z.....~..8.....9........f.+.....g...j.,9........n.X&........b..&..............\.=...&.U...r.....*...................;9....m.....J9.................&.....&.....{...........&.."..{....Y9....PU...........'..........,............U...........9....9......U.....'.....8..v. U..w..{.................U.........`hJ.`....v..`.5.`.......`.h.`.......`...`.......`.#.`.......`...`:.....'.C.G.c.s.w.{...........................+./.;._.c.o.s.{.............................#./.3.;.K.c.k.o...............X..............................................."...%...(...+.......1...4...7...:...=...@...C...F...I...L...O...R...U...[...X...[...^...a...d...g...j...m...p...s...v...y...|.......^...a...d...............................g...................j.. ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_BB.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.4062153517900993
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ4l/3Ncml9br9+laXF:Svvl/rl9br9+lwF
                                                                                                                            MD5:66C886025C39619832DE32CBBB59C320
                                                                                                                            SHA1:44C1F5D3E24FD31CF1BF16A57D1E85E39B1A25E9
                                                                                                                            SHA-256:B3DABA8E86AB757A149C8E0CF1DA466978447DD909D448B3D2C60A26A50516F5
                                                                                                                            SHA-512:24FC8BF2AF7619D30C4166C009B9184B5A0E20ECF8DC65BAAD815A84D6D29D780A3B0FAC59A9DDF9FE866CEDF74E1C09DB8112868670F1288DD983EC3EE9E73D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...........7.......=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_BE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.212653166597381
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMohxlrr9Srm:SvTr9Am
                                                                                                                            MD5:C2E9CF2310BD319B0614A1E34A018123
                                                                                                                            SHA1:87D8CA6FDE7F41B372ECEF50697E05A516E04E87
                                                                                                                            SHA-256:AB2E5AC853957BED7597A4879F1F589B909D1817747524D566D316EED84762EC
                                                                                                                            SHA-512:420280371516D51B3EB4EB58C3F387F3A7A492647D165EAA48448017CB619872BE0261175D9B4E49A02A77F7274585DE3372EED95E96B4DA4C564C1BF8953210
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.....=...m...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_BI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):108
                                                                                                                            Entropy (8bit):3.3360947400379724
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlNtls/slvl/CtUm59lQlvUJiotWFS:Sv1sEP65wlcJiA
                                                                                                                            MD5:6DE443A230DAD8CE2BFBF7D149F0A3DB
                                                                                                                            SHA1:71D6E1E95C1A9211A4B8FEF2B99FE16CFDFA78B8
                                                                                                                            SHA-256:A135770CC31B84370915424ED197BE648AC2932C5705C83C4EE4684228F5FC56
                                                                                                                            SHA-512:780EB1A30204932390AC442C12181D046FBDDB0A890FCABFE6297E31429CA325248251702216DA1B6CD8E5FE5BC8D7C14BB080AECA7F2D46A67D30A34386A778
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...F.B.u...........G................ ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_BM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.3869845825593305
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ7lMHc5/ar9kJl+lXF:SvMM3r9kr+xF
                                                                                                                            MD5:8ADFE63A4EF2890A4683B0FD83BDC8F6
                                                                                                                            SHA1:9848C61B5E1ABBC181DCAAC5684E8215303F5713
                                                                                                                            SHA-256:6052AF439E8F9B8060E0BEAE1898F522DBA2F576D8312E8333FD18281DF0E2B0
                                                                                                                            SHA-512:F4BD3C6CEFE2144F98E8CDE00D57C13726C82B6D1B50B69E3980159B8190413BB1EDC6BDE40B856B12B7F336660AA8C2C2EF9AD5B167FF1CAE7B30ACD1901436
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...........K.......=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_CA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):132
                                                                                                                            Entropy (8bit):3.7798152455379004
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tldgl/cmlplpl/l/d9pnfFPv5Cg4mPPBlF5mfn:SvCl/lp39p3CSPBlKf
                                                                                                                            MD5:5D286C21C4D15F50FED5F635140F2B82
                                                                                                                            SHA1:BA2822324A9421DDFCF06E1B22F0B3EE0465CFF1
                                                                                                                            SHA-256:4BD93820CBDFB828878E5F93A095C88AA28DA86C97156B356C64419182F8E409
                                                                                                                            SHA-512:CE7D66521B69B847FF0787867B97939FBB162664D44742C5AC2888F2FD7DAAEBC547338D1B35DA814CC157D3988CDE324265A3A46DAC77BC51D99911E5947246
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .0....................0......i~....... Y......../...s............P..=.........X..`... ... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_CC.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.360495279653912
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQgslll3NcX9br9iMQlXF:SvellSbr9iMQxF
                                                                                                                            MD5:4B29BE91DC84E7F6AA49B4DA4C713352
                                                                                                                            SHA1:8FF7934886BC6C413D73ED9346D0861FC727A593
                                                                                                                            SHA-256:471E0EAA79EB884F8AD830AEE0E90DBB71D23333BFF6B75BBB81D2C07953992A
                                                                                                                            SHA-512:D0341D781A179CBC793B461E09739F7B942486196174BA2CDD096C77B05D5214A4A1C8A4D8367C643AD72B047260F6A38F99FE62FD6341C27FF9E1F2FF685A38
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...........'.......=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_CK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.424598104200448
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQmMHcvOar99WDqXF:Svbvnr9iAF
                                                                                                                            MD5:4D60D12FDE7B39B06BEBA187E81F75E5
                                                                                                                            SHA1:54F37C003820A5BE07BF3854027B5DDC2D1DFF57
                                                                                                                            SHA-256:74DD8BC4EACBB1639CAB2A1937CAA8450985798B9D4AFFC74AAD0BCBFBA6B822
                                                                                                                            SHA-512:B8AB2825F2224723C88B7F95A751F780B1BB3D25B528BAACABDCC4C6D393C5C75B49ED611977DD63BD1BBEED04B2D82495E693966E663F4D4EF7BDD6075BFEC5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...................=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_CX.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.360495279653912
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQgslll3NcX9br9iMQlXF:SvellSbr9iMQxF
                                                                                                                            MD5:4B29BE91DC84E7F6AA49B4DA4C713352
                                                                                                                            SHA1:8FF7934886BC6C413D73ED9346D0861FC727A593
                                                                                                                            SHA-256:471E0EAA79EB884F8AD830AEE0E90DBB71D23333BFF6B75BBB81D2C07953992A
                                                                                                                            SHA-512:D0341D781A179CBC793B461E09739F7B942486196174BA2CDD096C77B05D5214A4A1C8A4D8367C643AD72B047260F6A38F99FE62FD6341C27FF9E1F2FF685A38
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...........'.......=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_FJ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.4062153517900993
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ9lsfcfqlnr9Om+ElXF:SvC2nr9OmNxF
                                                                                                                            MD5:819DCB2F55D6C2EAC0E11F7DB8CA73A0
                                                                                                                            SHA1:759659B2A8F1686FB974EBF3B21D98C977E1AE80
                                                                                                                            SHA-256:69AA0DB5BADBD481311E5346E0DC60C9518F579E8D96720CEAA0FFA12DD76869
                                                                                                                            SHA-512:554DC94B82587E452967CE047F701B2C38DBBBE33309803446EB5CF5D2FE404B1445D33EEAC8E73F0BA8C36C706E90FED60D8580EE055B428317A35370852557
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .3_...................3_.....i~.......2_..........=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_GB.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):244
                                                                                                                            Entropy (8bit):3.8405147762768803
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvDMKtwnr1pqMXn+lDopqMyl++lDopqMyl+i9XnAqX3EPBlO:SLMX+RFMuRFMy9XTHEbO
                                                                                                                            MD5:19A24A4CCB8FCD68C5326FA45213036C
                                                                                                                            SHA1:93EDE1CC01DF2F24966FEBE20AFE18364E912152
                                                                                                                            SHA-256:83CD4BA3C9A6CFC7E610F2F2A39F8334CFC24D6DF152DB81BDBD773F675CFFD7
                                                                                                                            SHA-512:7FFA3B70F684F1FD279D977CC1440F5A9546984CDEE92864C7E3B9C7E7034B6CC73453AFC20E4E22FB7F410FC69108C45E31FA37DA9AF427345662819474B2EA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..Y.....5...5..........Y(....i~...S.t. .H.e.l.e.n.a. .P.o.u.n.d...S.t. .H.e.l.e.n.a. .p.o.u.n.d...S.t. .H.e.l.e.n.a. .p.o.u.n.d.s........Y.....Y.......Y.Y......2.....{.....5..P8..P..=.........X..`(.. *.. ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_GG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):132
                                                                                                                            Entropy (8bit):3.748616647997833
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlw8+mlplplqlOm9bnTVGa9c0uqqeg4mPPBlF5uf:Svgsp+cm9bBGa93BSPBlSf
                                                                                                                            MD5:0F8AF8AFB2EB884C5B3F64D61F543A65
                                                                                                                            SHA1:9CBA67BF10742A50E14117FB13460A5B4E863FC1
                                                                                                                            SHA-256:BE85546033229C488F2B5867D698B7784C34BC0E01FFE5BF5A6029A711ABE843
                                                                                                                            SHA-512:52B8EB0956338068B7ECD501D169DD4729356FF4034AA5AE80FE8E34F62A31292A1D531F1A0C6B0E950F9844AA79A33E0DD21E3A4F61FB0B7719CC692CD107C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~.....\.Z.......c....................P..=.........X..`... ... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_GH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.375012347003209
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQq2/tNcoul9br93EXF:Svhm5u7br9eF
                                                                                                                            MD5:2DE5D922F65B17331E3A9686C9016EB2
                                                                                                                            SHA1:FEBC918CAB9ABCAEB9A56B1CB19097840164CD4B
                                                                                                                            SHA-256:37FB4759AC2A243D5A496F89ED01434261F009AF131D7BCF3F1FE321CD30E1F9
                                                                                                                            SHA-512:15A3C4C15D82F0D2463B5AC8066EB3319F18D07BCC9514B807FD3B7D34DF31E99913E48FBCB2AB97350554E8B82D4D381780C0ADB248946DE739A48C8B5CE1E0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..X....................X.....i~.....F..X..........=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_GM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.36775381332856
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQn2lll3NcRq9br9hvSXF:SvFl/39br9hwF
                                                                                                                            MD5:9DEDE71A7BA5D19B8E38F49D57C7A61C
                                                                                                                            SHA1:BA138185D4C22786931D18CA8A26A47B5B0EC4BC
                                                                                                                            SHA-256:94F002D9121FF120FED40933720C76CC0DB5360EE1FB53AD4F0CBAB81F715D47
                                                                                                                            SHA-512:528E2AAAAC5F7532A5EABD8626A1EF06B7DFD287BB951D691BF509F3F1B15BB816C03AE8E3FA9A6A4C3C8007BA34CB415CAE767B44B281B591377CDC4203852B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..~....................~.....i~........~..........=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.212653166597381
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMohxlrr9SF:SvTr9y
                                                                                                                            MD5:43351F1786026F7875F9B7FD7E906670
                                                                                                                            SHA1:D0EF80B1795FDBB1C1DC1CDF45A1574301DC9A3B
                                                                                                                            SHA-256:40747E88F5C7C216DD4F4EBE5034AC39E2DFC8F4DE75E2DDA34644C3F669B043
                                                                                                                            SHA-512:1EAFA0352F0559F3E97A98924E30C7B29994C3CBCE02F435E650BEA424DD5A89DF09BF6D08CFF19CECC32AD126BBACC15B8A36F4B63939DF4EA2B816B0C6FAE4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.....=...X...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_IE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.212653166597381
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwlpxlrmm9S9:Sv/Dz9q
                                                                                                                            MD5:F290C99A3E9C928023E949819DFE38EE
                                                                                                                            SHA1:E24AC7970AF336C9455B5211BF1B865237D46E05
                                                                                                                            SHA-256:6DD348D1795C7E999A650B6CBF254544F9D62EBE48F53230334BC0D6FA44D47D
                                                                                                                            SHA-512:873C23E1AEA6243172BD8F8EFA2CB1ED8580E1DEF84764CC05A3638118D4C01F17F8F51967DC050C903727CB1784C4EA01D274A45C4969D9FE1E7EFB881A0379
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.....=...X...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_JE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):132
                                                                                                                            Entropy (8bit):3.748616647997833
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlw8+mlplplqlOm9bnTVGa9c0uqqeg4mPPBlF5uf:Svgsp+cm9bBGa93BSPBlSf
                                                                                                                            MD5:0F8AF8AFB2EB884C5B3F64D61F543A65
                                                                                                                            SHA1:9CBA67BF10742A50E14117FB13460A5B4E863FC1
                                                                                                                            SHA-256:BE85546033229C488F2B5867D698B7784C34BC0E01FFE5BF5A6029A711ABE843
                                                                                                                            SHA-512:52B8EB0956338068B7ECD501D169DD4729356FF4034AA5AE80FE8E34F62A31292A1D531F1A0C6B0E950F9844AA79A33E0DD21E3A4F61FB0B7719CC692CD107C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~.....\.Z.......c....................P..=.........X..`... ... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_JM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.4438288734312166
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQAcCnr96gX+lXF:SvBnr96gXwF
                                                                                                                            MD5:8ACE823D7120F17D44DC8087C868375D
                                                                                                                            SHA1:249F56849ACF7729A97E12BDD10BBABDBCEBFADB
                                                                                                                            SHA-256:9AA37AEE2850A9441912D00F6E616F8D43D2BE529DEEE2C2C55C847B84A29942
                                                                                                                            SHA-512:1278EA7F6111524137ED7EFEC7AEC3AE6655F695590EDCBEDA6CA15D879F029867D9C74233BA155676490429982C072A73C02A8294F431235FEB57E1D182BA84
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .K....................K......i~.......J...#.......=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_MU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.394243116233978
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQQscEar9EksaXF:Sv+ar9EkswF
                                                                                                                            MD5:BA94F370052DB09825F99DC21C13A818
                                                                                                                            SHA1:F7BC0A8C9635D066FAE0115788DDE43DA3ACDC33
                                                                                                                            SHA-256:7E1293C620A4A3D213DE5E1DC26A96A20220D67089F44560FD7BF4427A53B647
                                                                                                                            SHA-512:23CF1673391B14881EFFA4E64E5F8E50B708371B94702EC5A47275BF74B4E969CA1F0C096CC3A1125CBF3AC8A146846C44EAD4B0629C693DFC8B83AE0199E97A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .y....................y......i~.....).x...........=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_NH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.683594117260545
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlKelBjlgljl/daAOklr:SBtkJTl4Pokx
                                                                                                                            MD5:30216BD52DB9E5F6903C7D289F9EA3CF
                                                                                                                            SHA1:32764706890683BDD4418636CFCDFFA3441E0F2F
                                                                                                                            SHA-256:C7A5FC96F44A5F07D49ABC3329850B4F96F009A155841DEF1608458ECDF8DE25
                                                                                                                            SHA-512:86FCBF850BFC0BAC769B0BFC0D52D55D1AD4EED7FCDCE22E01603479FC263CDAF2D81066165E2B7654035862569D51C4E538723844713EB2DEF30A45CA428CDC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...e.n._.V.U.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_NL.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.212653166597381
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMNsbxlH/d9SrJin:SvUu/d9Asn
                                                                                                                            MD5:B47E9660FE30618F88039419C8475F23
                                                                                                                            SHA1:7F17666DC08D5983D42E4845520CA1CBC4088338
                                                                                                                            SHA-256:7333C0831AC0A4C4D05C97BC62933652EDDA4990B3DB1639F12667FC667CDE3E
                                                                                                                            SHA-512:950310ACF817E4C35725969FFDD8D30B358806C1B0C992BA01710EFE2F032C48DE7AB5238904363AF8F49C5DE864BA7367C3A1AE222A29B57C5F5AFEA51B729E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.....=...m...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_NU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.424598104200448
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQmMHcvOar99WDqz:Svbvnr9iS
                                                                                                                            MD5:05C3D8C04759ADEECBAD23C2BDFB0F38
                                                                                                                            SHA1:391DFDB927C9E899D03E36E4194CCCCA7BA0A49C
                                                                                                                            SHA-256:6B1389234982B98E25ECEDDF46CDEE506D0CF54262C4A939708642C6B1D7126D
                                                                                                                            SHA-512:46129707EC0BE21605331CF8356F7D744548E21F9199B8D0F4986916EABD9BB41365022FD54747E6655C1424AD2BE53503E2382FA5027F350D92993DCCEB463E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...................=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_NZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.424598104200448
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQmMHcvOar99WDqdn:Svbvnr9io
                                                                                                                            MD5:B883698CF77CDB996E857F341B1C9BA1
                                                                                                                            SHA1:CD942555047C2BDEA5D6184C02FD9A32490A17F9
                                                                                                                            SHA-256:DA890EC860D17697A5617E9A5C14FC440C3B2F09B676A55CA0D9E6A0C3470777
                                                                                                                            SHA-512:AF5CAA818857C18DFE92AF5F3E150BCD9B2CB6E93623C4785826936F0FEC440AC58BBEB1EFF3ACC3F2C6BAD46D37670422EF9D738E1AB61605744F8585AAFA14
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...................=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_PG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):112
                                                                                                                            Entropy (8bit):3.559288179865805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlr6slzbmxrVNlQlomluYS:SvGsluxrVIomm
                                                                                                                            MD5:726CEF86D8C1B011252C5A66A94BA04E
                                                                                                                            SHA1:D1EC906BEF4E91022BEC578868CC45668BC8E739
                                                                                                                            SHA-256:DF8AE86A8D5419C01E79CC462744E59AE4C49EAE6E4644D1BFEF6B5E32AC87B2
                                                                                                                            SHA-512:403E51D974D5736494B105A3F1FA2E0FF1500A2CFB39D8D9C0FD31009B553DE19522CA9A17FA61FE5B21DDBCB1137202090BAF6621F579A8F394F5BE22485445
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~.........l..`...`..........=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_PH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.375012347003209
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQuslltNcRcMbr9yDklAll1Sz:SvsltMbr9QkilI
                                                                                                                            MD5:FB4EA48950E7CC41BD80093DAC47DA67
                                                                                                                            SHA1:5BB6736C1A64ACBBADCC4BA5C90BC0728D75AE2C
                                                                                                                            SHA-256:0271DAD13365259EB62E45A6256F72A7066202FFD4C2918EF1CBAD3666CDEE4C
                                                                                                                            SHA-512:E22A79683B03A57AE09EC7D7853DBA93D89E659649EFC33366418C2922BF478745F4C5C2FBDF3C989BDF334E41A22A5AD6A81AA730468798FD0F40A88A3856DF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .1f...................1f.....i~.......0f..........=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_PW.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.212653166597381
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMNsbxlH/d9SL:SvUu/d94
                                                                                                                            MD5:D6186AF2D25663529A1670149401C51A
                                                                                                                            SHA1:CC73AAA889E5F7DA2FCED52A80448C64C5756A9D
                                                                                                                            SHA-256:C3DD2043CDD9A4430624CF43FE1D7C65938E1A6D029ED3EE2632796A8D4ABB5A
                                                                                                                            SHA-512:C94E2E44C785414BF4894CAECE699225411498CAC344F761A8A047A4F82C15BD26D9F78834D515264805ED6454BCB3EF05E7E622E241F2E2C9678CDD0376CE31
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.....=...X...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_SD.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.212653166597381
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMNsbxlH/d9SL:SvUu/d94
                                                                                                                            MD5:D6186AF2D25663529A1670149401C51A
                                                                                                                            SHA1:CC73AAA889E5F7DA2FCED52A80448C64C5756A9D
                                                                                                                            SHA-256:C3DD2043CDD9A4430624CF43FE1D7C65938E1A6D029ED3EE2632796A8D4ABB5A
                                                                                                                            SHA-512:C94E2E44C785414BF4894CAECE699225411498CAC344F761A8A047A4F82C15BD26D9F78834D515264805ED6454BCB3EF05E7E622E241F2E2C9678CDD0376CE31
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.....=...X...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_SE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.4412840416380397
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQa2/tNc4ul9br9PsnEsliFqle:SvRmJu7br9PsXIH
                                                                                                                            MD5:27B69829128A9AEA476CE90876BECA03
                                                                                                                            SHA1:8208E75E95D0CC4A2035BC668C91B576B4562521
                                                                                                                            SHA-256:13641991A8FB83034EA5D0FF316CBCF6281F0C28A7DAB5C5BCF5C883AC9352CC
                                                                                                                            SHA-512:357D5D189F2540D7826C520C26228891967D46D4F8AE64EAD47C1EC4306CE05C4EB147A6A168043590BC98E6E9C4567B2E44E2476A771FD4A989A87BFDA28389
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..X....................X.....i~........X..........=.....m..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_SZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.4330652630584884
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQaCFcwutxr9orz:Sv5Crufr9o/
                                                                                                                            MD5:12C3DF8B34F6047DC34F8A9CF0ECA3F6
                                                                                                                            SHA1:795C14C238D93EA6A66DA60AFFDE3FB123397ED8
                                                                                                                            SHA-256:BAE05A5C78161EA471EF68C780B785397BA658757C6EEB1F336844B3AD70D0B0
                                                                                                                            SHA-512:D0F677BAFEF78B121F28CD6B82F9AA91AC47196886115A6D27F747FBE7F1F8E3E611E0C2F673F6D055C53628ED754EB9D1D4BDE169E67CDF4FFA2E1C86CF349B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~.....D.....;.......=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_TK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.424598104200448
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQmMHcvOar99WDqz:Svbvnr9iS
                                                                                                                            MD5:05C3D8C04759ADEECBAD23C2BDFB0F38
                                                                                                                            SHA1:391DFDB927C9E899D03E36E4194CCCCA7BA0A49C
                                                                                                                            SHA-256:6B1389234982B98E25ECEDDF46CDEE506D0CF54262C4A939708642C6B1D7126D
                                                                                                                            SHA-512:46129707EC0BE21605331CF8356F7D744548E21F9199B8D0F4986916EABD9BB41365022FD54747E6655C1424AD2BE53503E2382FA5027F350D92993DCCEB463E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...................=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_VU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):112
                                                                                                                            Entropy (8bit):3.477119983253645
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlfFzbiMXpreNQPsihMYVS:SvVXpKN9BYo
                                                                                                                            MD5:36BCDBB7F2D4F58E9B7401E1F1384F9D
                                                                                                                            SHA1:2A18EB208FE57FFEA76980870D325DE35E6926E6
                                                                                                                            SHA-256:283CCD85A7189582FA49525D1C8F066B0596DE4BF24E1D9772206FEF06804064
                                                                                                                            SHA-512:E477A781AA3FE20F274791DD67868920A3B5B49930AE7BD891350E2C2D341F45156DE2A46E296EF69B1ECF2E7D3A8FECF4645D347F2F7FDEAC39114E36641B3F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .i;...................i;.....i~...V.T.....j;h;............=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_WS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.4485425753126884
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQL/tNch9br9Qkl5/slz:Sv4Sbr9j5EF
                                                                                                                            MD5:62E083A9E3C1BACD700A6095B3A14810
                                                                                                                            SHA1:E3B3CE33AE8DC6F6F5BD38BB4836B3B4300417D7
                                                                                                                            SHA-256:5FAC493F3A9915B55444A4943A346A8A1AEF6604AC3F104BEBBA498BB040F050
                                                                                                                            SHA-512:729FBBE9264445DD32DA3C3F21A06A60481AB4363469B4527496BDD9184E909615F5472284C85C1BA47633E5E851DEFB51DD95F9701EEA2F1DEC9D0EFC676276
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..(....................(.....i~.....n..(..........=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\en_ZM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.405367334969678
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQxNcL7br9D/slz:Svz7br9DEF
                                                                                                                            MD5:5DDA0B8154CBC304A15D4F511F049B3A
                                                                                                                            SHA1:591C8A22B0328F5A5052CCF6ED1C818E258CC3AE
                                                                                                                            SHA-256:81029AA2C6FE3B71B79E3CC25D826A0FF11778E58F53C2CF7B278ED9816B4EB4
                                                                                                                            SHA-512:E38D104DA53639A1299D752FC52AA7D5E0F896EA33DB4C86CFA80466F8C09B2C04BFCF02FBCD9285DCC3EE7B43B5BBD03C49A04827B243D121F7C225893AEC57
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..~....................~.....i~.....l..~..........=.....X..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\es_EC.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.4485425753126884
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQUt9cWlnr93sKk9SAp:SvDt95r93I1
                                                                                                                            MD5:35371BB3EBCAE55EC196350C1C608F4A
                                                                                                                            SHA1:1BB4EE0D26E57059FCC5D32B5A114753B480921D
                                                                                                                            SHA-256:33301B54393153E40A050A5819DCAD5078D4B4AE9EB7E1CA906E7B05F0DF1D23
                                                                                                                            SHA-512:C4159219F10DC6FD4ADED5F194A5EF1BB7FDA7ADB508F063D989A52DAF51C5F6B47C737547B7BFC665456E478B5175F4A7AC1BC17A22F0F31487A4DCEF8AE320
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...........o.......=....._..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\es_GT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):164
                                                                                                                            Entropy (8bit):3.8935098827237504
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlErzmxrOZWpAlWllllK6BnoIF7nF5Y8q3x4k5w2lM9slF:SvamxrppAMPK6aIit3bah9EF
                                                                                                                            MD5:7CD5AA960C6BFB7C8FFF96CD2D315564
                                                                                                                            SHA1:F14D9F0E0454A6CAEB6D4D2EB20E5DF4D6FCBC63
                                                                                                                            SHA-256:F48A782BF243A05698C41EBDCACCA858262DAD9A17761D740756AC69406E0CD2
                                                                                                                            SHA-512:BE9283EA427E4F9C0F7FFEDE8F2A537918BDF8DFA9E434B703DEBDDE98CFCCBD6FA98DD3B1835E255BEC85DA616718325F33EABF6A2E8B51B3736D34A1167BCA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........!...!................i~...q.u.e.t.z.a.l.e.s.....L.....................................P..=........._..`... ... ...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\es_HN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.356367841934543
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ4sl/3NcP/Vbr9uZvSAp:SvG/6br9uZz
                                                                                                                            MD5:E95E77146E36FC58B4B5FF26A2844C23
                                                                                                                            SHA1:E43A3B54E8240027EF1F6ED96450CBE8230D8D8A
                                                                                                                            SHA-256:34B4424C04F937A586C3CD1289A2C8CD6D8C59208512EF2A596D518EC7048A61
                                                                                                                            SHA-512:C8294204BE46DA1B9CDBDCB416C4B3AF72F1584CC6D820B6D87CDC25433512370CF152F18F5369920A6E63E5EE3E0056814A49B92A1962FD7CF2D78A8D0EAC72
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...........................i~..................=....._..`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\es_PE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):112
                                                                                                                            Entropy (8bit):3.4168084876986144
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlCextbxrsS3hY1ohXF:SvSexLYc
                                                                                                                            MD5:6F4C386E2317A667B4C3EF5CFD97D309
                                                                                                                            SHA1:1AD06427484402B86ACB7EAA010ACBD9F52FD337
                                                                                                                            SHA-256:7B5820ADEEEF375B97F582BC21A64B4B804CD1BD9220F6A0E263C54BEB4C9CF8
                                                                                                                            SHA-512:82AD316C884980798B73F4E7C6DA2F81BB7E201E8FFB54F8DBA103C705EED2B0905DA619ACCF36D8233CD2DFE6FE1E39ED66C1963505117CA07702EC59F03AB8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .4~...................4~.....i~...S./.....5~3~............=....._..`... ~..`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\es_US.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):512
                                                                                                                            Entropy (8bit):4.772456815902694
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:7RJOmy5z+8sc+8s+IGzIVIcm2ZsOI27kAvH3rNBF:emk+Vc+V+Zsmqxr3rNz
                                                                                                                            MD5:0826A2157AE706C4A6A968E592F14FB2
                                                                                                                            SHA1:BC8A32BD1C15429DA3E1ED6CA5603F85933AFD36
                                                                                                                            SHA-256:D56C9F54B84F30BB7ACD65DABB8D2EEA8A835A48AE4C0394CCAF73E9799C44B0
                                                                                                                            SHA-512:6454ADB3FB79C677134946E2866BC5B8CA68C6046BFA2C07DF8B8E2B5590AC18E204C4243DE66DC9FACE666E8AC49EB129BD597401228DB993FBFBADF1C15E76
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................p.. .|S.....x...x...........J....i~...b.a.t...b.a.t.s...f.r.a.n.c.o. .C.F.A. .d.e. ...f.r.i.c.a. .c.e.n.t.r.a.l...f.r.a.n.c.o.s. .C.F.A. .d.e. ...f.r.i.c.a. .c.e.n.t.r.a.l........8........N...........Z.................2.........+.7.{.\..%\.\.,......'.................................................6..`.L.`....+...3.?.o.w.....E...H...K...N...Q...T...W...Z...J............S.`.S.`.........L.`{S.`........3.?.w.......h..Pk..Pp..Ps..Px..P}..P[.. _.. ..=........._..`M.. ]..Pc.. ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\et.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):27996
                                                                                                                            Entropy (8bit):4.614504697030006
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:JixwghJkN9+1vaogHqIKFhHUj7Wet0OueGyINABb0en3dMN/0DJaJo+mKCFsoGsQ:Jl79yLH3uuAi7pPRpF+BvmSQ6866XMgn
                                                                                                                            MD5:ED7C6D771A4BABCA93BC6422C1F35913
                                                                                                                            SHA1:526ACC093266F03C969A4EBAF0820F06DAB18C18
                                                                                                                            SHA-256:200A825E3A04F4870E89FE87396ED8D4F07D7886180E856D0AE4E2D4F52C7DF6
                                                                                                                            SHA-512:B5701D0C817816C89B4489167AFF08DD2AAF9BBDE54B1857DCB30430AD6C7ED5E1F5259D44C45E199C2A38A5F81FD067E6B21863E34A003EFE3EEC896EACCF37
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................G.. ..b.....O...O...............i~.......e.k.......h...b.e...k.u.l.d...e.k.....d...e.u.r.o.t...T.a.i. .b.a.a.t...p.l.a.a.t.i.n.a...I.i.r.i. .n.a.e.l...L...t.i. .l.a.t.t...T.a.i. .b.a.a.t.i...L...t.i. .r.u.b.l.a...G.h.a.n.a. .s.e.d.i...H.a.i.t.i. .g.u.r.d...L.a.o.s.e. .k.i.i.p...L.e.e.d.u. .l.i.t.t...M.a.l.t.a. .l.i.i.r...M.a.l.t.a. .n.a.e.l...P.e.r.u.u. .s.o.l.l...S.o.o.m.e. .m.a.r.k...T...r.g.i. .l.i.i.r...U.S.A. .d.o.l.l.a.r...I.i.r.i. .n.a.e.l.a...L...t.i. .l.a.t.t.i...P.e.r.u.u. .i.n.t.i...p.a.l.l.a.a.d.i.u.m...B.i.r.m.a. .k.j.a.t.t...E.e.s.t.i. .k.r.o.o.n...H.i.i.n.a. .j...a.a.n...K.o.n.g.o. .f.r.a.n.k...K.u.u.b.a. .p.e.e.s.o...N.o.r.r.a. .k.r.o.o.n...P.o.o.l.a. .z.l.o.t.t...S.a.m.o.a. .t.a.a.l.a...S.....r.i.a. .n.a.e.l...T.a.a.n.i. .k.r.o.o.n...G.h.a.n.a. .s.e.d.i.t...G.u.i.n.e.a. .s.y.l.i...L.a.o.s.e. .k.i.i.p.i...L.e.e.d.u. .l.i.t.t.i...M.a.l.i. .f.r.a.n.k.i...M.a.l.t.a. .l.i.i.r.i...M.a.l.t.a. .n.a.e.l.a...P.e.r.u.u. .s.o.l.l.i...S.a.i.r.i. .z.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ewo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2956
                                                                                                                            Entropy (8bit):4.406725586917464
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:CnrX51pSqfDsOqQOzyLIi1qVkABdmg0rXNINLIsgl+EtrDVEb4DVCktMcocsdqdn:CnDNSiQfzyLIi1qVkABAtisQEtrDVEba
                                                                                                                            MD5:EFC42652F7B90751789113B87FD388B1
                                                                                                                            SHA1:223811661ABA35BFD654380275908215D7EF8366
                                                                                                                            SHA-256:A921EF4BE3B6891E69ABD1196B4EBC7DA7BA6B66A9E52E236292735D6EA9ED38
                                                                                                                            SHA-512:C96C038DF51F289EC0990E93B20B517FFAA5226DFC81259D58D1B874871097CC0EE8FA2BC522BF9477E34919C317A18BCC792D830C34D73D23B0E1D3C998243B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................:............i~...Y.r.....S...l.i. .y... .G.i.n.....D.i.n...r. .y... .L.i.b.....F.Y.l...K. .y... .S.u...s...R.u.p... .y... .M.o.r...s...T.z.e.d... .y... .G.a.n.....D.i.r...m. .y... .M.a.r...g...F.Y.l...K. .y... .K.o.n.g.o...L.o.t... .y... .L.e.s.o.t.....R.u.p... .y... .S.[.s.[...l...R.u.p... .y... .[...n.d...a...S.i.l...K. .y... .K.e.n.i.....Y.[...n. .y... .H.a.p.T...n...B...r. .y... .E.t.s.i...p.i.a...D.i.n...r. .y... .T.u.n.i.s.....D.o.l...r. .y... .K.a.n...d.a...D.o.l...r. .y... .N.a.m.i.b.....K.w.a.t.s.a. .y... .Z.a.m.b.....L...v.Y.l.Y. .y... .S.u.d...n...S.i.l...K. .y... .S.o.m.a.l.....D.a.l.a.s... .y... .G...m.b...a...D.i.n...r. .y... .A.l.e.h...r.....D.o.l...r. .y... .L.i.b...r.i.a...F.Y.l...K. .C.F.A. .(.B.E.A.C.)...F.Y.l...K. .y... .B.u.r.u.n.d.....F.Y.l...K. .y... .K.o.m...r.i.a...F.Y.l...K. .y... .R.u.w.a.n.d.....F.Y.l...K. .y... .d.z.i.b.u.t.....K.w.a.t.s.a. .y... .M.a.l.a.w.....N.....r.a. .y... .N.i.h...r.i.a...P...l... .

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ff_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9159246284584364
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMcmt6E7lMUMbr+0mCn:Svwt6gmbrlmCn
                                                                                                                            MD5:A60E02569784AC9D5C76E3021322C822
                                                                                                                            SHA1:471960A6448F26BF0216F28F071E3860F1D6A271
                                                                                                                            SHA-256:338496AD90DF4581131F024DD945F5D7455F0B9969EA0C924E9F1BC142083B18
                                                                                                                            SHA-512:A2D57F8EFBE4E5D0B50FAF54C6C44CEECF0ADE4577872AF3CACE9DF64D1733A68325494694B03E3517877560BF12CC124F662AADDF8C1F68B97862E75FC0CEF2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ff_Latn_GH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.2245297862980866
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQBC8t9llUar9ctl7XllQ/x:Sv98sar9ctlz4x
                                                                                                                            MD5:4A4E3D003D05BB8B278D0482597BFFC0
                                                                                                                            SHA1:EF4D6632CB69E3D5ED90CD095966880CA30BC12F
                                                                                                                            SHA-256:DABB9431C7A2E8250BE1B94B959ECA790C62490E5C5AB82CA5F0381940A491E0
                                                                                                                            SHA-512:684EF0B3E3B83A81EF3DD71CFD1384D0FBD8EF842E69800D5B9DBDA0E6E38772068C4C756E576FD7CD72EB220BA01FDB535FA94A6C756D2B4C93E6C90465D6DB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .%....................%......i~.....F.F.................... $..`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ff_Latn_GN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.2054117237913244
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQc8t8twUMbr9eFXllQ/gn:SvGt88br9y4g
                                                                                                                            MD5:1E989F3CEB870F9ACE7CDB1C12459DA5
                                                                                                                            SHA1:C78A750241DCB7EFE69760BF84347A0C68A101E5
                                                                                                                            SHA-256:FB43E042B00EEC2D254953C37E777FE897084789DD9C3DED684D25402E419AEB
                                                                                                                            SHA-512:ECBDC7549C704B5D8C2155497CA88B060F9681F909FB9C72AC7BC24127FEDDC299E07C2E5739A21CF25B23FD900C04DCFCBB3069E1418FAA4C5179B224E86D7B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~.....A...................... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ff_MR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.897999040607968
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/dZmM9s0S:SBtkJYlU8g8l/dZmis0S
                                                                                                                            MD5:18812932A15AD38E6B9A8F570566656B
                                                                                                                            SHA1:405A965EA0765E855D77FE0C6EA7191E46CE23B7
                                                                                                                            SHA-256:62C7A572C1EA458431FDC9F85585CE9113EE58B11A5340A7C567077BE20E9A0D
                                                                                                                            SHA-512:4FFE48BF81A068FC2979A3A275263E1041C71F86D29EED05DC4CE79C81F42BF29D6B2837F7205DB0C4DEEF7EB8974E585EB405AD605E2EDCEA9B7F2F99286C46
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...f.f._.L.a.t.n._.M.R...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\fr_DJ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):108
                                                                                                                            Entropy (8bit):3.354613258556491
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlPllmslvl/etd5blHcd3WbS:Sv9/P25q7
                                                                                                                            MD5:EDFDD366A4DFFAD79CFF45EF6FCFB82A
                                                                                                                            SHA1:451163F2EBE883DE81408F6BBA915289B41BA064
                                                                                                                            SHA-256:D364DA1D51DDB165BE99BD14E24A5FEF6F3D31DC9DB124A37EEE96A5AF81022F
                                                                                                                            SHA-512:852B989E9F9CBEE6BC33D85545D0C199AC719B3DD905DD6AA02390142442957579CCE98D6DC350D31DDA70D5D72DCBB0EF06AC6E74AC9DDD025F302E40997653
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...F.d.j............................ ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\fr_HT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.2017664440253215
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQLt88tJlllxr95Ulaa/lllQ/e:SvU88Dfr9Klaat4e
                                                                                                                            MD5:F8D80FD6868C07AF457898561E8F4C3F
                                                                                                                            SHA1:AC8103B233797E1A85F5FB788E3082488FB589F3
                                                                                                                            SHA-256:F42501F923C7700F356F3B652F854C6E2F464050FF83BBEDDFC359F5A02B1465
                                                                                                                            SHA-512:FD5F4532C3DA8BA1340A7CB5E946D1DA126BDDA7D4F0EF11014A865B37B16FF6603A487DF2998E8BB8AB2693BBCC5CD4B4BF2EFF7BDCAAAAE5A3D7A40FD86F4C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...........................i~........................... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\fr_KM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.320723765282722
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQQC8t8llxr9I/lllQ/e:SvnC8S/xr9I/l4e
                                                                                                                            MD5:9B935877F813A2158ECC72B3081D68E0
                                                                                                                            SHA1:74F80FE301B832599BB9CB2C6F6D4BD364B45FAB
                                                                                                                            SHA-256:764184F3C340EA43C47DBCCD57EC8B19CAA26716E9357ACF537D701828C11E23
                                                                                                                            SHA-512:F3EE16A8A81EDA40C58298D56BC54AD542E36FDAAACC13A7BE1FBC960D1FEA073BC05F632E598693FC0A90C6B347DA2DCA45347A03F7EBC5595F96152C4AFD01
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..J....................J.....i~........J..;................ ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\fr_LU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):116
                                                                                                                            Entropy (8bit):3.518319734704497
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlEF1WyX9B/foEPPk/rlt/WbS:Sv8wyX9uEU/x7
                                                                                                                            MD5:3719864E845355E3AC1AF00991891781
                                                                                                                            SHA1:FD147748238B438580FFDCA88BE1CF56B77B90D4
                                                                                                                            SHA-256:32F686CBD6DE7F4FF7DE32E9F27DF09C1AC6B8DF5CF3B83104A2D9A4310B19D6
                                                                                                                            SHA-512:BE93B370190DC51B912E5003CFB621A1632BDACDC6902BE466C0E2765EEBAD593107CA1FA11AD3F3EA9FF888D33FEB5804DA044A1B265EFDAAEFDD8C25C60C9E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~.......*J................................... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\fr_TN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.305626015239453
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ2lU8til5r9coclllQ/e:SvhlU8Al5r9coi4e
                                                                                                                            MD5:A6F612B423C5B86E264AA30697698016
                                                                                                                            SHA1:2E92ADD395C97940B342A4C838119CB26A379DDB
                                                                                                                            SHA-256:F56D1903151E6996EACDA571FCAB55C0A3B2EE8AA47197E1FB830D621404B116
                                                                                                                            SHA-512:2B2D995CF082B00A0B2FDE045C355B5E1ADAC2651B190D9400BFD0F356F8D4BBE8E3564DB1B115F4012AE82CD1F19BBACF38E9154EA642D2E63DF44C2A1C4E4D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..<....................<.....i~.....S..<..K................ ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\fr_VU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):108
                                                                                                                            Entropy (8bit):3.3743856528799516
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlH/sE/slvl/vlrpzdk4hf/WbS:SvnEPFpC4v
                                                                                                                            MD5:C63F4F940C5BFEAD79B829A247416BE8
                                                                                                                            SHA1:4BDA3981C9AA407683E9117C9B5FAE57781659F3
                                                                                                                            SHA-256:591276400E07155857ECE28AE494590F0AB31C4E4867819004B6A30A4F279872
                                                                                                                            SHA-512:4130A1C0ED4A9F09366C343A243D250519ADEB75041DBB9CFC939E559B231BC0AED92D47E436A84CEBE42E6AA1CEABCCA951A6466DEEC7E8B760128F79573681
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .q@...................q@.....i~...V.T.....r@p@..................... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\gsw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):19300
                                                                                                                            Entropy (8bit):5.000586913903977
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:BELRUwy6FqW5aSpszoLYsTrqk2rhMdrNHAkfAQ968lh/y4j4wLiBTyqrx5:wVpszUfAQI540w+B2qrx5
                                                                                                                            MD5:82FFC675162421EEDB1B596B8E01CCAF
                                                                                                                            SHA1:2FD40735088CF2E3369FC7ED0A622C3FA5F5AD1F
                                                                                                                            SHA-256:7D654883517084A91A74FF12C31DFA634E14956F5AB057F6B37B4AA2DDE7A20A
                                                                                                                            SHA-512:A374086DE168A47028AE98BE7491519739CA632184E2501EF729A9FC4700189001754A1B241E94A5A44864B52DADF8F5AFDD1E38842BE5E19A82461DBAE242C5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..i..........................i~.....S...S.i.l.b.e.r...B.o.l.i.v.a.r...C.o.r.d.o.b.a...S.c.h.e.k.e.l...D.D.R.-.M.a.r.k...J.e.m.e.-.R.i.a.l...M.o.l.d.a.u.-.L...i...N...i.i. .Z.a.i.r.e...I.r.a.k.-.D.i.n.a.r...J.e.m.e.-.D.i.n.a.r...R.i.a.l. .O.m.a.n.i...U.A.E. .D.i.r.h.a.m...W.I.R.-.F.r.a.n.k.e...N...i.i. .D.i.n.a.r...N...i.e. .D.i.n.a.r...N...i.e. .Z.a.i.r.e...R.I.N.E.T.-.F.u.n.d.s...S.a.u.d.i.-.R.i.y.a.l...N...i.i. .K.w.a.n.z.a...N...i.e. .K.w.a.n.z.a...A.r.u.b.a. .F.l.o.r.i.n...K.o.m.o.r.e.-.F.r.a.n.c...T.e.s.c.h.t.w...h.r.i.g...A.l.t.i. .M.e.t.i.c.a.l...A.l.t.e. .M.e.t.i.c.a.l...Z.y.p.e.r.e.-.P.f.u.n.d...T.....t.s.c.h.i. .M.a.r.k...B.e.l.a.r.u.s.-.R.u.b.e.l...B.e.l.a.r.u.s. .R.u.b.e.l...F.i.d.s.c.h.i. .D.o.l.l.a.r...F.i.n.n.i.s.c.h.i. .M.a.r.k...I.n.d.i.s.c.h.i. .R.u.p.i.e...I.i.r.i.s.c.h.i. .P.f.u.n.d...M.a.l.i.s.c.h.i. .F.r.a.n.c...I.i.r.i.s.c.h.s. .P.f.u.n.d...L.e.t.t.i.s.c.h.i. .L.a.t.s...M.a.u.r.i.z.i.u.s.-.R.u.p.i.e...S.a.l.o.m.o.n.e.-.D.o.l.l.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\guz.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):820
                                                                                                                            Entropy (8bit):4.814630826299895
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:qlFttOax2QZw0nzJJWUNxupOhjQXHmIXclwYZg4YgQYYw0YgwY4DfP:qvT92QdzJJWuxusg5M+hHXHcXHDn
                                                                                                                            MD5:1392EA69A62CF00BA85CE95AB6EB8AB9
                                                                                                                            SHA1:4C11C54D4042DE6114AD7D3A1EC4BE769E6C896B
                                                                                                                            SHA-256:2BE1D03A372174CAE7B1A3FB840FD907DC3B386A36E4919E773F9C0C753E64BF
                                                                                                                            SHA-512:BD0C8942F12D7DB14BCD278ED6C0FBB78D11862F2FDEE746793923091216AB54A0D4A5856672C393B576891B4FCA8FFDAEAAE210A060BA073D7674A39EEE1588
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..j.............9.......S....i~.......ez..........,...z.....~..z....i8.....z..f....j..........n......Z8..b.vz....pT........\.x...&..%..r.!z..*.0T....K8........".$...........@T.....8.... T.....z.....z...........T....Tz..".......PT.....z..........`T...........T..................................R......z..v.Cz..w.......2z.....z.......`.).`.......`$..`....v..`HJ.`.......`.j.`.......`.<.`.......`.#.`.......`;..`.......`.5.`9.....'.C.G.c.s.w.{...........................+./.;._.c.o.s.{...........................#./.3.;.K.c.k.o.............S...................................V..............."...%...(...+.......1...4...7...:...=...@...C...F...I...L...O...R...Y...U...X...[...^...a...d...g...j...m...p...s...v...y...\..._...b...|.......................e...h...................k.. ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\he_IL.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.463875210299606
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/xr+yhll:SBtkJ1li6gml/xrjJ
                                                                                                                            MD5:C64F71AE20060954B9E32C5B9DA51C65
                                                                                                                            SHA1:1E33967C51E09874F6A1DE9A9C3539DB9CA82A63
                                                                                                                            SHA-256:1F132CA885D786C508137E5A798DCA175FDD0D486A134931FCC3803DB934B735
                                                                                                                            SHA-512:CAAAD60303A93E38E881D7FC3C711D7A52ACB59511A65BEE549193067F88B870BFF2DAEBDDFAE6D4ED366F93D3D7003EC5B0AC13890B9187F9A37D2BE8831D17
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\hi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10328
                                                                                                                            Entropy (8bit):5.378216758722473
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:3Kf0cw5YaCLA/By5ElFqp0H965qGRdzPIDubtA+NwLztfrXCXuNfF5F49gfXFX:3Kf4O3LApyKlFqp0d65vdzPIDmAuGrX3
                                                                                                                            MD5:1C375201EF871D78B9AF4541FCFBAEB7
                                                                                                                            SHA1:3F78A9335BB7B06FDB50D2F60524E004687464BF
                                                                                                                            SHA-256:6262C801357F2F55A21099750B822A4FBE92F57AD61E9A24DBA67C514EC18BFD
                                                                                                                            SHA-512:EF6FF223443F54D6D250E9020CFFC7BB4AD9117854C6132495B6AFEB6411DA7F92AE325E70053AC7F221053141BE7B3B5BA05EF9EE5C66DF2C10CA238E4C8EAF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..(..........................i~...2.G...../.B.0.K...%.>... .,.9.$...!... ...>.0.M.......@.(.@. ./.B...(...+.<.?...@. .!.I.2.0.../...(.@. .0.?./.>.2...8...&.@. .0.?./.>.2...8...K..... .$.>.2.>...$...>...@. .0.B.,.2.....0.>.(.@. .0.?./.>.2.....(.>.!.>... .!.I.2.0.....<.$.0.@. .0.?./.>.2.....>.(.?./.(. .8.G.!.@.....K.....(. .*.>.....>...!.H.(.?.6. ...M.0.K.(...,.0...B.!.>. .!.I.2.0...,.9.>...>... .!.I.2.0.....?.8.M.0. .*.>.....!...5.(.A...$.B. .5.>.$.B...(.G.*.>.2.@. .0.A.*.....-.>.0.$.@./. .0.B.*.....2.G.8.K.%.K. .2.K...@.....M./.B.,.>... .*.G.8.K...../.>.(.@...<. .!.I.2.0...*.G.0.B.5.?./.(. .8.K.2...,.9.0.@.(.@. .&.?.(.>.0...,.M.0.B.(.G... .!.I.2.0...9.H.$.?./.>... ...0.M.!...(.G.*.>.2.@. .0.A.*./.>...[.C.F.P.]. .+.<.M.0.H.........%.?./.K.*.?./.(. .,.?.0.....H...,.?./.(. .!.2.>.8.@.....H...M.8.?...(. .*.G.8.K.....K.0...M...K. .&.?.0.9.......K.2.M.!.K.5.(. .2.?./.B...2.@.,.?./.>... .&.?.(.>.0...2.G.,.(.>.(.@. .*.>.....!...5.?./.$.(.>...@. .!.K.......8.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\hsb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24104
                                                                                                                            Entropy (8bit):4.712237459846695
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:VgdtirpPXIYuDvJ3cIPJ6LflILdNs5w+Be5wbNNAoiyBvdjQC/HyBvxuH:WarltaJ9//ae58NNhB1QCKBpW
                                                                                                                            MD5:F1A01E4D112CCEC206A8D4B4487A9F3C
                                                                                                                            SHA1:AA33CAE756D82EDAB0979F6DF594C74E009CBD33
                                                                                                                            SHA-256:F2C01BF31365CDDE555E5A8916C157BD07300E9C2568D4A1CB1E705DF6DD290B
                                                                                                                            SHA-512:3469C820F73402BB76990447954EAF725A98A197A844ECF677401925527A10AEC2325BED8EB1523D47CF97BAD30F4DF37B8B0627651DF69536AE9DBDB78583F3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................z.. .Ek.........................i~...e.u.r.a.j...e.u.r.o.w.......s.k.a. .k.r...n.a...C.F.P.-.f.r.a.n.k.a.j.......s.k.e. .k.r...n.y...d.a.n.s.k.a. .k.r...n.a...j.a.p.a.n.s.k.i. .y.e.n...k.u.b.a.s.k.i. .p.e.s.o...r.u.m.u.n.s.k.i. .l.e.u...u.z.b.e.k.s.k.i. .s.u.m...Z.A.E. .d.i.r.h.a.m.a.j...c.h.i.l.s.k.e. .p.e.s.a...d.a.n.s.k.e. .k.r...n.y...k.u.b.a.s.k.e. .p.e.s.a...m.e.x.i.s.k.e. .p.e.s.a...b.o.B.h.a.r.s.k.i. .l.e.w...m.o.l.d.a.w.s.k.i. .l.e.u...n.j.e.z.n.a.t.a. .m...n.a...a.w.e.d.s.k.a. .k.r...n.a...a.l.b.a.n.s.k.e. .l.e.k.i...i.r.a.n.s.k.e. .r.i.a.l.e...j.a.p.a.n.s.k.e. .y.e.n.y...l.a.o.s.k.e.j. .k.i.p.a.j...n.j.e.z.n.a.t.e. .m...n.y...o.m.a.n.s.k.e. .r.i.a.l.e...u.z.b.e.k.s.k.e. .s.u.m.y.......s.k.e.j. .k.r...n.j.e...a.w.e.d.s.k.e. .k.r...n.y...g.i.n.e.j.s.k.i. .f.r.a.n.k...g.u.y.a.n.s.k.i. .d.o.l.a.r...t.u.r.k.o.w.s.k.a. .l.i.r.a...a.r.m.e.n.s.k.e. .d.r.a.m.y...a.r.u.b.a.-.f.l.o.r.i.n.a.j...b.o.l.i.w.i.s.k.e. .p.e.s.a...b.o.B.h.a.r.s.k.e. .l.e.w.y...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\hu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17536
                                                                                                                            Entropy (8bit):4.959205276436812
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:7iybMkDgXl3qw4Q34PjjY8ZkIbD8gr2j1xKy4qcQb/l8jeyw3:7iybv3Q347EqkgD8qqz4q9WNw3
                                                                                                                            MD5:5383BDDBBFAB5E5DC4BEA93ACD196F20
                                                                                                                            SHA1:2BB45F16CCAB8DFF37EECA78BFF26D313AC9C3F8
                                                                                                                            SHA-256:6E80AE2FFE677BFF06D1B976D7C38ED799DF537BE27BC457BA599E6C477145F9
                                                                                                                            SHA-512:AC921FC8A2C506E67FEBFF9F9F20A2565610D9F084317B40F8AD29CA1E2874F2B7B621C86A32F6A74E8676DE6C2DA0CAD8693053545AA8417729C8357986DA15
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..b..........................i~...e.u.r.....A.r.a.n.y...E.z...s.t.....r. .f.o.n.t...a.l.b...n. .l.e.k...g.r...z. .l.a.r.i...j.a.p...n. .j.e.n...l.e.t.t. .l.a.t.s...p.e.r.u.i. .s.o.l...r.o.m...n. .l.e.j...t.h.a.i. .b.a.h.t...P.a.l.l...d.i.u.m...p.a.l.l...d.i.u.m...E.A.E.-.d.i.r.h.a.m...U.S.A.-.d.o.l.l...r...a.n.g.o.l. .f.o.n.t...d...n. .k.o.r.o.n.a...i.r...n.i. .r.i.a.l...k.u.b.a.i. .p.e.s.o...k...n.a.i. .j...a.n...l.a.o.s.z.i. .k.i.p...o.m...n.i. .r.i.a.l...t...r...k. .l...r.a...L.e.t.t. .r.u.b.e.l...O.l.a.s.z. .l...r.a...R.I.N.E.T. .t.Q.k.e...p.e.r.u.i. .i.n.t.i...B.e.l.g.a. .f.r.a.n.k...b.r.a.z.i.l. .r.e.a.l...c.h.i.l.e.i. .p.e.s.o...c.s.e.h. .k.o.r.o.n.a...g.h...n.a.i. .c.e.d.i...h.o.r.v...t. .k.u.n.a...i.r.a.k.i. .d...n...r...j.e.m.e.n.i. .r.i.a.l...k.a.t.a.r.i. .r.i.a.l...s.v...d. .k.o.r.o.n.a...s.z.e.r.b. .d...n...r.....r.m...n.y. .d.r.a.m...B.u.r.m.a.i. .k.y.a.t...F.i.n.n. .m.a.r.k.k.a...M...l.t.a.i. .f.o.n.t...M...l.t.a.i. .l...r.a...s.z.e.r.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ii.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):152
                                                                                                                            Entropy (8bit):4.1638619626994275
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlEEl9c8mar2EK/quyUF9l9leLtj4ln1WJpQblNSn:Sv9xmarYLFH9sql1H6
                                                                                                                            MD5:E99F8FE932619D1E5334493348CF1FAA
                                                                                                                            SHA1:C8EDF32EE0C1355487DAD53962CDC89A1FB04BF2
                                                                                                                            SHA-256:8B822DC2CBE588F01B5BEB687D94A357A6067B6642E5CCB11D5EE50FEE18FBCC
                                                                                                                            SHA-512:4F6D3B3ED47671D0371BDC7B4135EA77620E7F8AE99F1D784AAE216314F0FA16F5B6DF68E1BB2F2BDC8CCD7DD20F5FC059A1326DD822DDED1847AFE6C9C59BC1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...I..... ............... .................................................. ...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\in.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):84
                                                                                                                            Entropy (8bit):2.629834328222692
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlZelgylslplglcmW+r:SBtkJQltWpglcm5r
                                                                                                                            MD5:F32320EA5FE246573DD5431780C8E7D1
                                                                                                                            SHA1:6A5690A8AFD89298CC72539969EFFAE2C28AC0D5
                                                                                                                            SHA-256:A0D8434CF75D4905D038721A9A08BD937E892340D562066E635BE15B2732A47C
                                                                                                                            SHA-512:54EC429700159CDD16565586F7B6608616C94B9A45934942DF424A21E2B68A1E0F73A799583D839C36467B4ED0F4A940CADE4CB0F892DFF5B676B36B479074B7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...i.d...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\it.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):21948
                                                                                                                            Entropy (8bit):4.554031255092286
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:26Y5iiYp9QzB6zd4t27Zab9LYv1Wj3hV6023K0yyz0ivETPDS0:26Y5TYp9PLab9LYv1AhV5PyzHEr
                                                                                                                            MD5:084738626C1795938D159AC95E778226
                                                                                                                            SHA1:DD2D361E48BE28A9D2F2DDC8EC9D96A2148F9467
                                                                                                                            SHA-256:064AC9D3CB56B798C5280F5581F9EE63B39E79AF9D6551CA159145A754F9E158
                                                                                                                            SHA-512:8A7EA4496BEFA0C288212EA4945A3F84EB9867575A41E47A0B4A25FA12924ACEBA19F1C3AB33C8D154171033BAA33D6ABDF96D5E6B232823B8FA2E95D539570C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................].. ..f.....g...g...........y....i~.....E...N.K.r...a.r.g.e.n.t.o...p.l.a.t.i.n.o...p.a.l.l.a.d.i.o...l.e.u. .r.u.m.e.n.o...s.u.m. .u.z.b.e.c.o...l.e.i. .r.u.m.e.n.i...b.i.r.r. .e.t.i.o.p.e...c.o.r.o.n.a. .c.e.c.a...d.r.a.m. .a.r.m.e.n.o...l.e.v. .b.u.l.g.a.r.o...m.a.n.a.t. .a.z.e.r.o...p.e.s.o. .c.i.l.e.n.o...b.i.r.r. .e.t.i.o.p.i...f.o.n.d.i. .R.I.N.E.T...f.r.a.n.c.h.i. .C.F.P...l.e.i. .m.o.l.d.a.v.i...m.a.n.a.t. .a.z.e.r.i...r.u.b.l.i. .r.u.s.s.i...s.u.m. .u.z.b.e.c.h.i...k.i.p. .l.a.o.t.i.a.n.o...l.a.t.s. .l.e.t.t.o.n.e...l.i.r.a. .s.i.r.i.a.n.a...s.o.m. .k.i.r.g.h.i.s.o...c.e.d.i. .g.h.a.n.e.s.i...c.o.r.o.n.e. .c.e.c.h.e...d.i.n.a.r.a. .s.e.r.b.i...d.r.a.c.m.a. .g.r.e.c.a...k.i.n.a. .p.a.p.u.a.n.e...k.i.p. .l.a.o.t.i.a.n.i...l.a.t.i. .l.e.t.t.o.n.i...l.e.v.a. .b.u.l.g.a.r.i...l.i.r.a. .m.a.l.t.e.s.e...l.i.r.e. .s.i.r.i.a.n.e...p.e.s.o.s. .c.i.l.e.n.i...p.e.s.o.s. .c.u.b.a.n.i...r.i.a.l. .o.m.a.n.i.t.i...s.o.m. .k.i.r.g.h.i.s.i...t.a.l.a. .s.a.m.o.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\jmc.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):836
                                                                                                                            Entropy (8bit):4.807826091118605
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:mlUNtOaxijlw0+CzJ1WUNxupJLjQXHm3XcfwYXg4YgQYYwS/YgwYYCS9lgAF:mE9i1+wJ1Wuxu/g+M4PHXHCXnCS/gAF
                                                                                                                            MD5:F09BA6EC637887BF827CE42F664D181E
                                                                                                                            SHA1:E8B2FB8468FE264361EC4A788641E06461A94764
                                                                                                                            SHA-256:CD71CE1AFEB8C8186B7EFE0554748EE91D8F1B9CB38F8E7E96BA39BF29594523
                                                                                                                            SHA-512:17A26D4186AAECAE49AE06F9A992580DD3A11A20DB5E22486F2B76A4ED192074CE6911CF920ACA84614EAFE758124C1BC9455282318C07B78CC8783FD8133573
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..j.............:.......U....i~.......ez..........,...z.....~..z....i8.....z..f....j..........n......Z8..b.vz....pT........\.x...&..%..r.!z..*.0T....K8..........$...........@T.....8.... T.....z....~............T....Tz..".......PT.....z..........`T...........z.....T..........................*.......R......z..v.Cz..w.......2z.....z.........`.).`.......`$..`....v..`HJ.`.......`.j.`.......`.<.`.......`.#.`.......`;..`.......`.5.`:.....'.C.G.c.s.w.{...........................+./.;._.c.o.s.{.............................#./.3.;.K.c.k.o...............U...................................X..............."...%...(...+.......1...4...7...:...=...@...C...F...I...L...O...R...[...U...X...[...^...a...d...g...j...m...p...s...v...y...|...^...a...d...........................g...j...................m.. ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\kam.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1060
                                                                                                                            Entropy (8bit):4.7221842930318525
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:eZJ99kEMjDA3WkPsgUA8GQHraBJ7xuxhlusg5Mu60nioHKw1Yy4vN8:eZJ3kEMjk3WkPsEQHk9xClusg+u603Kk
                                                                                                                            MD5:8EEE1A017181DBDB2F476DCDB3BAD06E
                                                                                                                            SHA1:9D00AF947B0257F63EE7C73A147A586903D433BC
                                                                                                                            SHA-256:59BE5709F034598424DFA7D0EDA9732CE8DF91BF15F4304D3A6F86570B9CDD64
                                                                                                                            SHA-512:92FFE2B7BB52829E3D3011530B43D4EE7F64DE27965EF04845EC430EA46D19D34B1BE6E31B29F0D0B22AC24F5B5703EA324E2C11BD6A26F5E9AA0B8F6A82C19C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..j.............9............i~...V.a.u.n.d.i. .y.a. .M.i.s.i.l.i...V.a.i.n.d.i. .y.a. .S.u.d.a.n.i...S.i.l.i.n.g.i. .y.a. .U.g.a.n.d.a...S.i.l.i.n.g.i. .y.a. .S.o.m.a.l.i.a...S.i.l.i.n.g.i. .y.a. .T.a.n.z.a.n.i.a...V.a.i.n.d.i. .y.a. .S.a.n.t.a.h.e.l.e.n.a.......ez..........,...z.....~..z.....^.....z..f....j..........n..........b.vz....pT........\.x...&..%..r....*.0T....K8........".c...........@T.....8.... T.....z.....z...........T....Tz.."........~.....z..........`T...........................................v.Cz..w.......2z...............`.).`.......`$..`....v..`HJ.`.......`Kk.`.......`.j.`.......`.<.`.......`.#.`.......`7k.`.......`;..`.......`.5.`9.....'.C.G.c.s.w.{...........................+./.;._.c.o.s.{...........................#./.3.;.K.c.k.o.................r...u...x...{...~...................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\kde.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):932
                                                                                                                            Entropy (8bit):4.788982151830266
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:+lEycUANa5Oax1Sjlw0+CzJfUNxupJLjQXHm3XcHQY/g4YgwYYQZqC9137F:+hNA0591S1+wJfuxu/g+MwnnXnaqCf7F
                                                                                                                            MD5:20F7805D337BD52D7A12418CB764963E
                                                                                                                            SHA1:414B34F58AB8DE66AD29539FDD305E3AA7EEEBE1
                                                                                                                            SHA-256:939679C5B4476543E75D3CCCE43CAEF45B4C14BF2586939B6291DAA49FFE3BB6
                                                                                                                            SHA-512:4103B49304C8AEE969ECC3511EB61AE85BE1E6B311784E7A1FC9C3B2AA586CB6DB918BD8BF75C704172664979F9E7D1565F85734891A56AFFB076C6DF670326F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..j.............:.......m....i~...S.a.r.a.f.u. .y.a. .C.h.i.j.a.p.a.n.i...D.i.r.h.a.m. .y.a. .F.a.l.m.e. .z.a. .C.h.i.a.r.a.b.u.......ez..........,...z.....~..z....i8.....z..f....j..........n......Z8..b.vz....pT........\.x...&..%..r.!z..*.0T....K8..........$...........@T.....8.... T.....z....~............T....Tz..".......PT.....z..........`T...........z.....T..........................*.......R......z..v.Cz..w.......2z.....z.........`.k.`.......`$..`....v..`HJ.`.......`.j.`.......`.<.`.......`.#.`.......`;..`.......`.5.`:.....'.C.G.c.s.w.{...........................+./.;._.c.o.s.{.............................#./.3.;.K.c.k.o...............m...1...4...7...:...=...@...C...F...p...I...L...O...R...U...X...[...^...a...d...g...j...m...p...s...v...y...|...........s...........................................................v...y...|...................................................... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\kea.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5008
                                                                                                                            Entropy (8bit):4.886877793642687
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:I9hgUnLJ5R/z6xYa+Joas55k23iLMGcZMGjJvLkl8a/kfudw1SbO5X3a7MF:IFz9aENdLgZFDkzZag0
                                                                                                                            MD5:3F199424F472D4CAFF20AA10D70EC0C3
                                                                                                                            SHA1:8B7FBC7B6282D5D59BA2EFFD389501B191BAD9E3
                                                                                                                            SHA-256:21EB2C74131DE72B3A7A3A1A7CABEDD1BC8FC9904AB28FC04E71F93AB229665D
                                                                                                                            SHA-512:CABF7A8F94C72200B764C2B4804E3B57D98D530A3D36F49C7D6C2DF58B828C654B0CF392283F4EEEE8CB40DBC0FF148F45364CC96C66CDC3AB59B85665A6CCE2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~........ ..S.i.l.i...O.u.g.i.a...K.u.a.n.z.a...2...1...4.8...9...L.i.l.a.n.j.e.n.i...B.i.r. .e.t.i.o.p.i...I.u.a.n. .x.i.n.e.s...L.i.r.a. .t.u.r.k.u...D.i.n.a.r. .l.i.b.i.u...K.u.r.o.a. .s.u.e.k.u...D.o.l.a. .m.e.r.k.a.n.u...F.r.a.n.k.u. .s.u.i.s.u...I.e.n.i. .j.a.p.o.n.e.s...Z.l.o.t.y. .p.o.l.a.k.u...L.i.b.r.a. .e.j.i.p.s.i.u...L.i.b.r.a. .s.u.d.a.n.e.s...P.e.z.u. .m.e.x.i.k.a.n.u...R.u.p.i.a. .i.n.d.i.a.n.u...X.e.l.i.n. .k.e.n.i.a.n.u...B.a.h.t. .t.a.i.l.a.n.d.e.s...D.i.n.a.r. .a.r.j.e.l.i.n.u...D.i.r.e.n. .m.a.r.o.k.i.n.u...D.o.l.a. .k.a.n.a.d.i.a.n.u...D.o.l.a. .l.i.b.e.r.i.a.n.u...D.o.l.a. .n.a.m.i.b.i.a.n.u...F.r.a.n.k.u. .r.u.a.n.d.e.s...K.u.a.x.a. .z.a.m.b.i.a.n.u...K.u.r.o.a. .n.o.r.u.e.g.e.s...R.i.a.l. .b.r.a.z.i.l.e.r.u...L.o.t.i. .d.i. .L.e.z.o.t.u...D.i.n.a.r. .d.i. .B.a.r.a.i.n...D.i.n.a.r. .t.u.n.i.z.i.a.n.u...F.r.a.n.k.u. .b.o.r.u.n.d.e.s...F.r.a.n.k.u. .k.o.n.g.o.l.e.s...K.u.a.x.a. .d.i. .M.a.l.a.u.i...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\kok.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):364
                                                                                                                            Entropy (8bit):4.294839676088542
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SviaSSpfr98gF8Mzlh2NjNxklNXNLXVn+r4pwOVQXqxs8Lp4Xi6fXBFn:2SS78gVlhib+ZXo4agwYJSXi6fBFn
                                                                                                                            MD5:AAC55F615221DA508B258FCD517BBA24
                                                                                                                            SHA1:B942A5A847FBC777638DE99EE017905882A6AB81
                                                                                                                            SHA-256:3B88AFE697D2A8D855FDD591800BE0C4AD03CCAAABF931451239771BCCDFC51F
                                                                                                                            SHA-512:FDC03E9543757D6A3B4214BC2689BA234D39B467BCCB17B3DC75A027485FC8B90813E56F1B731ABABCB2F0D4B55A6D0AFBC2BD17CACF66FA0DADF6993CF2BC6F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................K.. ........S...S.........../....i~...................&...\...................................W.........+...o.......\.........................&...............................................W.........+...o.........................................W.........+...o...-..P0..P3..P6..P9..P<..P?..PB..PE..P............/.. ...P=.. H..P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\kw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):96
                                                                                                                            Entropy (8bit):2.8008721598698436
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlu112lFvlslpl9lcmNIlh+T/+k:SBtkJK0lslL8mNIl0Ck
                                                                                                                            MD5:9DD8151D818086771071512D5D9FF53F
                                                                                                                            SHA1:AF9D1CA60F5409F23BA1BB9313C07D7EDA5450A1
                                                                                                                            SHA-256:A93CC1B747B7EDD0A3D8EEC3E93B7B8DB002C0F761461233FC5EE403CE9BA983
                                                                                                                            SHA-512:80C17F667BD2128E552E59738162AD142EECAC4A37140E7E7648E69084C072329CB26A21471F1E0FE1E4D1B8372A0C8069FC0342F23DFFCF94CCEDFAB9AA40F3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...2...1...4.8...5.6.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\lg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2136
                                                                                                                            Entropy (8bit):4.392005258298755
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:ItKPgrqPYL1O9ebsttOuRID/Kl31fPW14CwlUUNl2TGQQ/gVQOYDm/1:XPgrqPYL1dbYO7KfxWUNoQ4VQOYU1
                                                                                                                            MD5:A183C17F3D86F1A50A0ABAD447046767
                                                                                                                            SHA1:AB019CA7552CEB0A2DA87827A426298827D945A3
                                                                                                                            SHA-256:FE719F9605B06633985335ECCCE90086EF63114FACBFA688F6146B981377BA58
                                                                                                                            SHA-512:2B5C4E0043808952593E56C4C32BFFC0DAAF5FAF51C54CEAC0EC0442180D95908F9C31F53091B56BC16A7F1546B3D192327352E8451A5195BAE94A5D663EDDE5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .sl.............:.....f.|....i~...L.e.w.o.n.e...S.e.d.i. .e.y.. e.G.a.n.a...L.o.t.i. .e.y.. e.L.e.s.o.s.o...Y.e.n.i. .e.y.. e.J.a.p.a.n.i...B.i.i.r.u. .e.y.. E.s.y.o.p.y.a...D.o.o.l.a. .e.y.. e.K.a.n.a.d.a...F.a.r.a.n.g.a. .e.y.. e.G.i.n.i...K.w.a.n.z.a. .e.y.. A.n.g.o.l.a...D.a.l.a.s.i. .e.y.. e.G.a.m.b.y.a...D.i.n.a.a.l.i. .e.y.. e.L.i.b.y.a...D.o.o.l.a. .e.y.. e.L.i.b.e.r.y.a...F.a.r.a.n.g.a. .e.y.. e.K.o.n.g.o...S.i.l.i.n.g.i. .e.y.. e.K.e.n.y.a...D.o.o.l.a. .e.y.. e.N.a.m.i.b.i.y.a...F.a.r.a.n.g.a. .e.y.. e.K.o.m.o.r.o...P.a.w.u.n.d.i. .e.y.. e.M.i.s.i.r.i...P.u.l.a. .e.y.. e.B.o.t.i.s.w.a.n.a...R.u.p.i.y.a. .e.y.. e.B.u.y.i.n.d.i...D.i.n.a.a.l.i. .e.y.. A.l.i.g.e.r.y.a...F.a.r.a.n.g.a. .e.y.. e.J.j.i.b.u.t.i...F.a.r.a.n.g.a. .e.y.. e.b.u.r.u.n.d.i...N.a.k.i.f.a. .e.y.. E.r.i.t.u.r.e.y.a...P.a.w.u.n.d.i. .e.y.. e.S.u.d.a.a.n.i...D.i.n.a.a.l.i. .e.y.. e.B.a.a.r.e.e.n.i...D.o.o.l.a. .e.y.. A.w.u.s.i.t.u.r.e.l.y.a...P.a.w.u.n.d.i. .e.y.. e.B.u.n.g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\luo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1152
                                                                                                                            Entropy (8bit):4.689701312866842
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:JadneOOsz4RDMJ8rxeYtUUECUAmRdCJ1vXuxusg5MEn2Gsn:JadnEszsDMCrxBtJUHRgfPlsg+U2Go
                                                                                                                            MD5:F7549BA4E2B54F0B20C5BA3ED9DADFDE
                                                                                                                            SHA1:76EDFFE824583140DE9260FE557E44E584A64159
                                                                                                                            SHA-256:AF88C435B7F8A71DAEFFD949AA22EA804C94B7EA6B48203D9AD80C575EDBB869
                                                                                                                            SHA-512:CEB0D078053DDFE408A0A6EC38D50298B1CD9153DCEB38E73B3202C94A6528F2537652C4B6F20132597067A0BB979BC8B88AFF8EED81226764B707C7B608818B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..j.............9............i~...D.o.l.a...Y.e.n. .m.a.r. .J.a.p.a.n...S.e.d.i. .m.a.r. .G.h.a.n.a...D.o.l.a. .m.a.r. .K.a.n.a.d.a...P.a.u.n.d. .m.a.r. .M.i.s.r.i...D.o.l.a. .m.a.r. .L.i.b.e.r.i.a...S.i.l.i.n.g. .m.a.r. .K.e.n.y.a...B.i.r.r. .m.a.r. .E.t.h.i.o.p.i.a...P.u.l.a. .m.a.r. .B.o.t.s.w.a.n.a...P.a.u.n.i. .m.a.r. .U.i.n.g.e.r.e.z.a.......ez..........,...z..............z..f....j..........n..........b.vz........&.....r.!z..*.0T....K8........"....................8.... T.....z.....z...........T....Tz..".......PT.....z..........`T...........T..................................R.........v.Cz..w.......2z.....z.........`.).`....~..`fk.`.......`$..`.......`Tk.`....\..`xk.`....v..`HJ.`.......`.j.`.......`.<.`.......`.#.`.......`;..`.......`.5.`9.....'.C.G.c.s.w.{...........................+./.;._.c.o.s.{...........................#./.3.;.K.c.k.o.........................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\mas.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3176
                                                                                                                            Entropy (8bit):4.059150453036504
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:quxuRuW4u/uyukunLuuuEuNucusu9uRutuCuHux6ubuYWuYuujuhu2uSusuZuNui:quxuRuVu/uyukuLuuuEuNucusu9uRutF
                                                                                                                            MD5:11579580FF3CF5452330D88EDA9EDCEB
                                                                                                                            SHA1:A5EAEAD3D1F90889631FCDB0EACF4FE703DB62A2
                                                                                                                            SHA-256:D120179E43075CE550A4E3C40BF69E578379FE494204301AA0BDA3DA6FDEE44B
                                                                                                                            SHA-512:F6A139A1E6D1611947564C0919392401351C3295D55A65EADE888A1D9305F888D658BFC4C39D1AF7E4DB8A78608B2E6C3318E69F7BC98D536C5EDDFCB9A75CF8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................9............i~...I.r.o.p.i.y.i.a.n... .e. .G.i.n.e...I.r.o.p.i.y.i.a.n... .e. .C.h.i.n.a...I.r.o.p.i.y.i.a.n... .e. .G.h.a.n.a...I.r.o.p.i.y.i.a.n... .e. .I.n.d.i.a...I.r.o.p.i.y.i.a.n... .e. .K.e.n.y.a...I.r.o.p.i.y.i.a.n... .e. .K.o.n.g.o...I.r.o.p.i.y.i.a.n... .e. .L.i.b.y.a...I.r.o.p.i.y.i.a.n... .e. .M.i.s.r.i...I.r.o.p.i.y.i.a.n... .e. .S.a.u.d.i...I.r.o.p.i.y.i.a.n... .e. .l.e.o.n.i...I.r.o.p.i.y.i.a.n... .e. .A.n.g.o.l.a...I.r.o.p.i.y.i.a.n... .e. .B.u.k.i.n.i...I.r.o.p.i.y.i.a.n... .e. .G.a.m.b.i.a...I.r.o.p.i.y.i.a.n... .e. .J.a.p.a.n.i...I.r.o.p.i.y.i.a.n... .e. .J.i.b.u.t.i...I.r.o.p.i.y.i.a.n... .e. .K.a.n.a.d.a...I.r.o.p.i.y.i.a.n... .e. .K.o.m.o.r.o...I.r.o.p.i.y.i.a.n... .e. .L.e.s.o.t.o...I.r.o.p.i.y.i.a.n... .e. .M.a.l.a.w.i...I.r.o.p.i.y.i.a.n... .e. .M.o.r.i.s.i...I.r.o.p.i.y.i.a.n... .e. .M.o.r.o.k.o...I.r.o.p.i.y.i.a.n... .e. .R.w.a.n.d.a...I.r.o.p.i.y.i.a.n... .e. .S.a.m.b.i.a...I.r.o.p.i.y.i.a.n... .e. .S.u.d.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\mgo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):168
                                                                                                                            Entropy (8bit):3.8675109447643528
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tloFelfdll8lCtVXMXlWtKlFiO6PePllnuW5vTVntRb1hp0lFuQFn:Svo6mlCtVXMsKlv62eW5b4/F
                                                                                                                            MD5:02EE73C7EDDE3DC0377FCE196E3FA6A0
                                                                                                                            SHA1:F4CC1350E289EC27383C3BBDAFBFDBB9D96B1B70
                                                                                                                            SHA-256:11D7D17E54504159416F09275A922376D8E961E3D3AD5380CDD959A513E8E33F
                                                                                                                            SHA-512:AAC5AD50A6DA2D3E43FE918F5274F2DD98DA622222C9C9D4B84AC239A5C122A2BDF44C2C93307D5866AAEB5E3075D166C589A9D6B94B3529E1C27BB550949C27
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........"..."................i~...s.h.i.r.....i.k.u. .i.k.a.p. .m.T...T.....v.............................................. ...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ms.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6440
                                                                                                                            Entropy (8bit):5.321424177187323
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:e2YmABKNZXPhwk3f/7VRt/giMw7qX8FoX:e8ABKN8Sjnt/JJ7qXb
                                                                                                                            MD5:C7C7AD6300F54EEB29208C8051E2A48E
                                                                                                                            SHA1:FE566931939B0F2789E2BF2B6846E37DEFE5E8E5
                                                                                                                            SHA-256:BD1A97A7CD9271408CA39E365B93572A47A9043FFD5844E6D25959FDB2A4BE30
                                                                                                                            SHA-512:C982A08641087A4EEC661F29DD13C23AE8039CAA037C9880E540EEC429E2A9746CC2E387F38FF3C1C43A43DA4975E65B9CE52CE72270F24BA3E3D46E490F6121
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................8.. ..h.....B...B................i~...D.o.l.a.r. .A.S...2...1...4.9...2...Y.e.n. .J.e.p.u.n...D.i.n.a.r. .I.r.a.q...P.a.u.n. .M.e.s.i.r...P.a.u.n. .S.u.d.a.n...P.a.u.n. .S.y.r.i.a...P.a.u.n. .L.u.b.n.a.n...K.r.o.n.e. .N.o.r.w.a.y...P.a.u.n. .B.r.i.t.i.s.h...R.i.e.l. .K.e.m.b.o.j.a...Z.l.o.t.y. .P.o.l.a.n.d...D.o.l.a.r. .B.a.h.a.m.a.s...D.o.l.a.r. .J.a.m.a.i.c.a...D.o.l.a.r. .S.u.r.i.n.a.m...F.r.a.n.c. .C.o.m.o.r.i.a...K.r.o.n.a. .I.c.e.l.a.n.d...P.a.. a.n.g.a. .T.o.n.g.a...S.y.i.l.i.n.g. .K.e.n.y.a...R.u.b.e.l. .B.e.l.a.r.u.s...P.a.u.n. .G.i.b.r.a.l.t.a.r...P.e.s.o. .D.o.m.i.n.i.c.a.n...S.o.m. .K.y.r.g.y.s.t.a.n.i...S.y.i.l.i.n.g. .S.o.m.a.l.i...S.y.i.l.i.n.g. .U.g.a.n.d.a...D.i.r.h.a.m. .M.a.g.h.r.i.b.i...H.r.y.v.n.i.a. .U.k.r.a.i.n.e...L.i.l.a.n.g.e.n.i. .S.w.a.z.i...L.i.t.a.s. .L.i.t.h.u.a.n.i.a...C.o.l.o.n. .C.o.s.t.a. .R.i.c.a...S.y.i.l.i.n.g. .T.a.n.z.a.n.i.a...C.o.r.d.o.b.a. .N.i.c.a.r.a.g.u.a...D.o.l.a.r. .N.e.w. .Z.e.a.l.a.n.d...D.o.l.a.r. .T.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ms_BN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.309432036254817
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQw68t1ar9nRillQ/6n:SvW83ar9nRi46
                                                                                                                            MD5:B0E942760DB021CF5F6A685A52F93393
                                                                                                                            SHA1:C82429E77F6595E40CEFB6B20AA5E0A71CA07625
                                                                                                                            SHA-256:CF21EE5E58ED6E2911AABD6D9FEA7B7258C3483B46ED4706A6CDBA9254E06CBC
                                                                                                                            SHA-512:9E347D9C136C9DD64F6E6EE52D8AAFA34BDF719ECB3721459484C923CB89E118686A4E57478B10BE7B6A9BE3FCE5ECB07F3300993EED928BA979016CBF8779BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...........O................ ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ms_SG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.3446273605383543
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ7sC8t0/Uar9wRPfllQ/6n:SvSf82r9wRX46
                                                                                                                            MD5:F674503A784DB3D59664FE097D5ADDBE
                                                                                                                            SHA1:6163F03FEDFBE16B37BA26CE2B3DED856E02C831
                                                                                                                            SHA-256:F9557DA8973FE1AA3F34253D0B457197517AF1D0FACEF3D8CC279D8E55A11F0C
                                                                                                                            SHA-512:C5B9815666E193317E3FD48448BC74B7D5590D4B825199DF00BAEDC4E30DDAE93032B754D81CBB2D9D50F47DDFE444166298A566DD2385648B11C6D7FBB5B595
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .AU...................AU.....i~.......@U................... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\mua.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2552
                                                                                                                            Entropy (8bit):4.169327394737595
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:EtVvGUGWKAQsUj0XSAbcCA1LmkBtZKUPl7hpCa/kHlZbnZ57qXIgVIy:xfzt5Aw55mFMlfCa8HlZjZZaVIy
                                                                                                                            MD5:3ADC590CE77F36881EE933974FF2B2F3
                                                                                                                            SHA1:230B8CB512EE56978149C3F20DF3A2CEFCED36C6
                                                                                                                            SHA-256:36B5EE66B95FDC5E5EC1018E9D230D1AD30C8818A8DADD22F9C9A457636FF43B
                                                                                                                            SHA-512:C4C0EB48F167AB6B8CA6CF07C95CF8AD80A5F36E565F820FEFA39D99DEBB0156B87947E1D02D49D17FBE77710BBC8D2501CA189E2B185CCB42E36B1D40488360
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................r.. ........v...v...:............i~...s.o.l.a.i. .B.E.A.C...s.o.l.a.i. .E.u.r.o...s.o.l.a.i. .G.a.n.a...s.o.l.a.i. .S.y.i.K...S.o.l.a.i. .M.a.r.o.k...S.o.l.a.i. .S.w.i.s.s...s.o.l.a.i. .B.C.E.A.O...s.o.l.a.i. .E.g.y.p.t...s.o.l.a.i. .G.u.i.n.e...s.o.l.a.i. .I.n.d.i.a...s.o.l.a.i. .J.a.p.o.K...s.o.l.a.i. .K.e.n.i.a...s.o.l.a.i. .K.o.n.g.o...s.o.l.a.i. .L.i.b.y.a...S.o.l.a.i. .H.e.l.e.n.a...S.o.l.a.i. .M.a.l.a.w.i...S.o.l.a.i. .R.w.a.n.d.a...S.o.l.a.i. .U.g.a.n.d.a...s.o.l.a.i. .A.n.g.o.l.a...s.o.l.a.i. .E.r.i.t.r.e...s.o.l.a.i. .K.a.n.a.d.a...S.o.l.a.i. .A.m.e.r.i.k.a...S.o.l.a.i. .A.r.a.b.i.y.a...S.o.l.a.i. .M.a.u.r.i.c.....S.o.l.a.i. .S.a.i.c.h.e.l...S.o.l.a.i. .S.a.u.d.i.y.a...S.o.l.a.i. .Z.a.m.b.i.y.a...s.o.l.a.i. .A.l.g.e.r.y.a...s.o.l.a.i. .B.a.r.e.n.y.a...s.o.l.a.i. .B.u.r.u.n.d.i...s.o.l.a.i. .E.t.i.o.p.i.a...s.o.l.a.i. .G.a.m.b.i.y.a...s.o.l.a.i. .K.o.m.o.r.y.a...s.o.l.a.i. .L.e.s.o.t.h.o...S.o.l.a.i. .N.a.m.i.b.i.y.a...S.o.l.a.i. .N.i.g.e.r.i.y.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\nb_NO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.463875210299606
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/xr+yhll:SBtkJ1li6gml/xrjJ
                                                                                                                            MD5:C64F71AE20060954B9E32C5B9DA51C65
                                                                                                                            SHA1:1E33967C51E09874F6A1DE9A9C3539DB9CA82A63
                                                                                                                            SHA-256:1F132CA885D786C508137E5A798DCA175FDD0D486A134931FCC3803DB934B735
                                                                                                                            SHA-512:CAAAD60303A93E38E881D7FC3C711D7A52ACB59511A65BEE549193067F88B870BFF2DAEBDDFAE6D4ED366F93D3D7003EC5B0AC13890B9187F9A37D2BE8831D17
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\nd.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3144
                                                                                                                            Entropy (8bit):4.159629520426389
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:zQsWdLLyOZff33PxoYDUg1NWSKtuUwMHi6GgCEggBgUqhFxNco3VYH9p5TF:0s4n1ZX3/KYPNWSUQMHi6GgCEggBsNm7
                                                                                                                            MD5:46A43A4245169E5189454DCF45D7A522
                                                                                                                            SHA1:704869CBF47DB78B44C1B3D0791361C49F5AA2C8
                                                                                                                            SHA-256:4AF5EA2804C8A5BE433B721CF0F144ABDB26C84E89EA1EDF80E8C218DCC60FC5
                                                                                                                            SHA-512:98C46A75483AA3F8A55C78522DF0E17599139C9A2823D2AFCFE9EAAC4CE56D2B1690474B9AA1CC70CD7F548ADA9514C7E643788B2A44C0DBBC2AB99E9F28023C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..#.............:.....9......i~...L.e.y.o.n.i...D.o.l.a. .l.a.s.e.A.r.a.b...S.e.d.i. .y.a.s.e. .G.h.a.n.a...F.u.l.e.n.k.i. .C.F.A. .B.E.A.C...R.i.y.a.l. .y.a.s.e. .S.a.u.d.i...R.u.p.i. .y.a.s.e. .I.n.d.i.y.a...D.i.n.a.r.i. .y.a.s.e. .L.i.b.y.a...D.o.l.a. .l.a.s.e.E.t.h.i.o.p.i.a...D.o.l.a. .y.a.s.e. .A.m.e.l.i.k.a...D.o.l.a. .y.a.s.e. .K.h.a.n.a.d.a...F.u.l.e.n.k.i. .C.F.A. .B.C.E.A.O...F.u.l.e.n.k.i. .y.a.s.e. .G.i.n.e...Y.e.n.i. .y.a.s.e. .J.a.p.h.a.n.i...D.a.l.a.s.i. .y.a.s.e. .G.a.m.b.i.a...D.i.n.a.r.i. .y.a.s.e. .S.u.d.a.n.i...D.o.l.a. .y.a.s.e. .N.a.m.i.b.i.y.a...D.o.l.a. .y.a.s.e. .Z.i.m.b.a.b.w.e...F.u.l.e.n.k.i. .y.a.s.e. .S.w.i.s.i...K.w.a.c.h.a. .y.a.s.e. .M.a.l.a.w.i...K.w.a.n.z.a. .y.a.s.e. .A.n.g.o.l.a...L.o.t.h.i. .y.a.s.e. .L.e.s.o.t.h.o...N.a.k.f.a. .y.a.s.e. .E.r.i.t.r.e.a...D.i.r.h.a.m. .y.a.s.e. .M.o.r.o.k.h.o...D.o.l.a. .y.a.s.e. .A.u.s.t.r.a.l.i.a...D.o.l.a. .y.a.s.e. .L.i.b.h.e.r.i.y.a...F.u.l.e.n.k.i. .y.a.s.e. .K.h.o.n.g.o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\nn_NO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.463875210299606
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/xr+yhll:SBtkJ1li6gml/xrjJ
                                                                                                                            MD5:C64F71AE20060954B9E32C5B9DA51C65
                                                                                                                            SHA1:1E33967C51E09874F6A1DE9A9C3539DB9CA82A63
                                                                                                                            SHA-256:1F132CA885D786C508137E5A798DCA175FDD0D486A134931FCC3803DB934B735
                                                                                                                            SHA-512:CAAAD60303A93E38E881D7FC3C711D7A52ACB59511A65BEE549193067F88B870BFF2DAEBDDFAE6D4ED366F93D3D7003EC5B0AC13890B9187F9A37D2BE8831D17
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\nus.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):116
                                                                                                                            Entropy (8bit):3.4731032476541825
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlEFu4gG98G4PPfXkhlt/WVGFn:Sv8vH98pnfUzzF
                                                                                                                            MD5:8EC60D7E1E4F6BDD711B9202D84A910B
                                                                                                                            SHA1:F38271A99673959E89952ABA17CBAC11300789DE
                                                                                                                            SHA-256:4753735BDA4C84D96BDB31FE7308CCF3E51EFD4F69CE5D979061AE1BB96ABCBF
                                                                                                                            SHA-512:2A351102B47C019D100B7A62EBEC2FBFBFF897AFEF61BBA479893F5093AF69BC80F2EBFB59D5AAC9826C62E75EAF13DA6C54854C0227F2A3EA2BB300B776561F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~.....:.....\.........+...................... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\os.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):708
                                                                                                                            Entropy (8bit):4.586640180253403
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:tyoaYzmu+SDy4hH4Bfky4p45ky4O4uIy6TT3HktNpkZDzgICpA4S:twSe4hYB94aL4LnWpQIICLS
                                                                                                                            MD5:4DD053ED8488B02A8264823DC7E50691
                                                                                                                            SHA1:0B270780E4D4B76FCA61A5C81B31E98AD44D0DC1
                                                                                                                            SHA-256:0B775254239B2E0CB70F743F8441354B0201D4CACF940EB1B9E0A46034936895
                                                                                                                            SHA-512:A9D1A615846F376548049A23A88E1135F1707FCB323EA1F89536545E10DB1030D6E95FCD1CD6B8AD6204503BFFD630B0F45D7E7C8045EF9F7565C7380A522F35
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..........................i~.....0.@...!.>.<...A.>.<.K...5.2.@.>.9.K.......(.-.K. ...>.;.;.0.@.......(.-.K. .4.>.;.;.0.@.......(.-.K. .4.>.;.;.0.@.K.....@.0.7.8.;.8.0.3. .@.5.0.;.....@.8.B.0.9.=.0.3. .$.C.=.B.......7.>.=.3... .2.0.;.N.B.....1.@.0.7.8.;.8.0.3. .@.5.0.;...1.@.8.B.0.9.=.0.3. .D.C.=.B...=...7.>.=.3... .2.0.;.N.B.....1.@.0.7.8.;.8.0.3. .@.5.0.;.K...1.@.8.B.0.9.=.0.3. .D.C.=.B.K...=...7.>.=.3... .2.0.;.N.B...9.K.......%.........\.4.....................C.......R...................a...........s.......Q.................p.................W.........o.................................W.........o......P...P...P...P...P...P...P............... ... ...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\pa.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12396
                                                                                                                            Entropy (8bit):5.379106910189353
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:Phu+NHII33D1BLJ1QrEPvbvhBIIO/YBIIia:Ph3NHII33D7LJWr4vbTIfoIla
                                                                                                                            MD5:F2059E93C133A6143B34AF48A333BD55
                                                                                                                            SHA1:2A5AA56185EB0B822C17D444D30EB19E34A8D29E
                                                                                                                            SHA-256:B1315B76D99537AB084241C84FFF885DC4860B93C82C2E838FEC9577E5FD8340
                                                                                                                            SHA-512:80F5F97F32856F5498468D9B55BAA76A1C6ED5B521A9DFFF98F00667557B5A3423AF6A5FF7011439391B622FA0576EDC7D0DB655D843A9D3EB2A2F9EBD1925B8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..b...................P......i~.../.B.0.K...8.K.(.>.....>...&.@...%.>... .,.>.9.$.....$.0.@. .0.?...2.....?.2.@. .*.G.8.K.....@.(.@. ./.A...(.....*.>.(.@. ./.G.(.....0...(. ...>.0...../...(.@. .0.?...2.....0.>.(.@. .0.?...2.......>.(.@. .0.?...2.....?...,.(. .*.G.8.K.....>.(.>... .8.G.!.@...$.A.0...@. .2.@.0.>.....?.8.0.@. .*.L...!...8.>...&.@. .0.?...2...9.H.$.@. ...L.0.!.G...-.>.0.$.@. .0.A.*.........0.?.8.<. .*.L...!.....%.K.*.@..... .,.?.0.....0.>...@. .&.?.(.>.0.....?.(.@. .+.M.0.H...........>.....(. .!.>.2.0.....>.0.!.(. .&.?.(.>.0.....L.....(. .*.H.....>...!.H.(.?.8.<. ...0.L.(...+.<.?...<.@. .!.>.2.0...,.0...B.!.>. .!.>.2.0...,.0.B.(.G... .!.>.2.0...,.G.2.@...<. .!.>.2.0.....K.2.!.K.5.(. .2.G...../.B.....8... .!.>.2.0...2.>.....?..... ...?.*...8.5.?.8. .+.M.0.H.......8.>...K..... .$.>.2.>...8.@.0.@..... .*.L...!...8.K.5.@...$. .0.B.,.2...-.>.0.$.@. .0.A.*...........?...$. ...A.&.0.>...(.G.*.>.2.@. .0.A.*.....8.G.8.<.2.8. .0.A.*.......0...@.(.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\pt_LU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.3715072703051296
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ0ElHc0ar9Hs9k9ScVn:SvZRr9XHV
                                                                                                                            MD5:C194FF74C6B65FAE4832F1ABDAA218A1
                                                                                                                            SHA1:712282E2B74418EE0CD6FC661A72A88486A9E3B2
                                                                                                                            SHA-256:0E986C574F9E6AA4F786ED2A4A1B825759062EB04FED0938679010A2E6CBA24B
                                                                                                                            SHA-512:715B11D01C31819B2BFB80EC36624F4D59F1670853E265365D95405EEE53583D55FA25CAC03CBE7EDD72287062C963A293E713AA117BB81C2E4A0C8698E8E6AC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...................=........`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\pt_MZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):112
                                                                                                                            Entropy (8bit):3.4368702719143505
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlud4tbwmyPmKPrR1mCFofGFn:Sv+/mjKTRxFo+F
                                                                                                                            MD5:EE2F8917C4703ED35301B8302B298E2D
                                                                                                                            SHA1:9BF02E717B3D8B199D63D92C4776E24032F9BC5B
                                                                                                                            SHA-256:42A9D4F0CE1791C474F85337BA0896FDB2312AB5CF2035B70AB28D6AB1DFEF82
                                                                                                                            SHA-512:2512CF617BD7A2BC1721A5169EA5EA8D6B8FCC2C479CB7CC9592F8AF9A80A9CCE4F0A08D0290E424C67EA894EB0D10CAEA8547413265835D471C99F9F2B30D85
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...M.T.n..................=........`... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\qu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):116
                                                                                                                            Entropy (8bit):3.4571882910706795
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tldc4jUMXsSGTkRolJpxK9Cfn:SvPjdgTkRoz+y
                                                                                                                            MD5:91E165EABC558593B37DC907C2363727
                                                                                                                            SHA1:93FC06CEE99BA16800A6CDAFD0726ED42047118A
                                                                                                                            SHA-256:C9589538FCEB262D36E1F687FEC5870853CFC51D63F5F6C27E5969B274C9B238
                                                                                                                            SHA-512:CB31FCCA7B53F825683BE4895E6F137CB1E024A40C80D95650223382ED0BFB0C4C7ADC1E2407E084D05AB1C3AD3AF89C97297CDB6E0E7E9591A4D91DB8B2F1B5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...S./.......6.......................... ...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\res_index.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4372
                                                                                                                            Entropy (8bit):5.024738835036758
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:rDb3gZi8lV09u1gAmcN0wBLVcXyRubMNpRPNpT8zWgjHZ98053f7qhnxBxB1YX0O:rH3qi5+gAyY1/TH4c053zqhnx84+97td
                                                                                                                            MD5:CE5342334637D420ADBEEAAB1563E387
                                                                                                                            SHA1:8695516224B0998CA0C1A8C0420D63D9AF1C17D0
                                                                                                                            SHA-256:D2CABE6B3BDC84B56F8C091DC908714FFEA4C7EE2598B97CD1F5E4647D018258
                                                                                                                            SHA-512:AC2A1C5F4F1B720F42786E381B6ECFD75EDD214D0FBA5BC83483D513F71EDFDAC6EDC3F5680B868319466E75DE450DFAD10D958CBA287112AA593984D6A439AC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................;.. ....i...=...=...........;...InstalledLocales.af.af_NA.agq.ak.ar.ar_AE.ar_DJ.ar_ER.ar_KM.ar_LB.ar_SA.ar_SO.ar_SS.asa.ast.az.az_Cyrl.az_Latn.az_Latn_AZ.bas.be.bem.bez.bg.bm.bn.bo.bo_IN.br.brx.bs.bs_Cyrl.bs_Latn.bs_Latn_BA.ca.ca_FR.ccp.ce.ceb.cgg.chr.ckb.cs.cy.da.dav.de_CH.de_LI.de_LU.dje.dsb.dua.dyo.dz.ebu.ee.el.en.en_001.en_150.en_AE.en_AG.en_AI.en_AT.en_AU.en_BB.en_BE.en_BI.en_BM.en_BS.en_BW.en_BZ.en_CA.en_CC.en_CH.en_CK.en_CM.en_CX.en_CY.en_DE.en_DG.en_DK.en_DM.en_ER.en_FI.en_FJ.en_FK.en_FM.en_GB.en_GD.en_GG.en_GH.en_GI.en_GM.en_GY.en_HK.en_IE.en_IL.en_IM.en_IN.en_IO.en_JE.en_JM.en_KE.en_KI.en_KN.en_KY.en_LC.en_LR.en_LS.en_MG.en_MO.en_MS.en_MT.en_MU.en_MW.en_MY.en_NA.en_NF.en_NG.en_NL.en_NR.en_NU.en_NZ.en_PG.en_PH.en_PK.en_PN.en_PW.en_RW.en_SB.en_SC.en_SD.en_SE.en_SG.en_SH.en_SI.en_SL.en_SS.en_SX.en_SZ.en_TC.en_TK.en_TO.en_TT.en_TV.en_TZ.en_UG.en_VC.en_VG.en_VU.en_WS.en_ZA.en_ZM.en_ZW.es_419.es_AR.es_BO.es_BR.es_BZ.es_CL.es_CO.es_CR.es_CU.es_DO.es_E

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ru.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):37816
                                                                                                                            Entropy (8bit):4.615966856428233
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:yKdeOm8jlvhrjl2dVK2sEN+FOVcCy4qPCmGQBtIUHPm:BoJulvhrjQdVK2yX4qPTf0UO
                                                                                                                            MD5:0A898D04EBF2E9C7EEBB86D9430F0CF6
                                                                                                                            SHA1:BB516A6BF5A411D1AEF14094842A47311CFB3BAB
                                                                                                                            SHA-256:F7EE4E84B49780925AE392BD4391B9A947333DFD91D7A6FEC6B69B10C46A071F
                                                                                                                            SHA-512:3A9EE20AB8A2BACFC22287C5BE4A22406A4A8A287885F19F3C779298B1818AF5CA64395E9AC831836A0693CF50428E75DDE1AA35E90B98FD701F1335217663DC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB.................$. ..b......$...$...............i~.....6.0.....5.2..."...".....0.8.@.....>.B.8...3.@.=.....0.D.3.0.=.8.....;.>.B.K.9.....>.;.>.B.>...!.5.@.5.1.@.>.....0.;.;.0.4.8.9...4.8.@.E.0.<. .....-...4.>.;.;.0.@. .!.(.......>.2.K.9. .7.0.8.@... .C.1.;.L. .!.!.!. ...4.8.@.E.0.<.0. .....-...4.>.;.;.0.@.0. .!.(.....2.0.B.C. ...0.=.C.0.B.C...3.0.=.A.:.8.9. .A.5.4.8...3.0.=.A.:.8.E. .A.5.4.8...4.>.;.;.0.@. .$.8.4.6.8...;.0.>.A.A.:.8.9. .:.8.?...D.@.0.=.:. . .C.0.=.4.K...4.0.B.A.:.8.E. .:.@.>.=...4.8.@.E.0.<.>.2. .....-...4.>.;.;.0.@.>.2. .!.(.....B.C.@.5.F.:.8.E. .;.8.@...G.5.H.A.:.8.E. .:.@.>.=...O.?.>.=.A.:.8.E. .8.5.=...0.;.1.0.=.A.:.8.9. .;.5.:...4.0.B.A.:.0.O. .:.@.>.=.0...4.>.;.;.0.@.0. .$.8.4.6.8...8.@.0.=.A.:.8.9. .@.8.0.;...>.<.0.=.A.:.8.9. .@.8.0.;...@.C.<.K.=.A.:.8.9. .;.5.9...B.C.@.5.F.:.0.O. .;.8.@.0...C.7.1.5.:.A.:.8.9. .A.C.<...D.@.0.=.:. ...6.8.1.C.B.8...D.@.0.=.:.0. . .C.0.=.4.K...G.5.H.A.:.0.O. .:.@.>.=.0...M.D.8.>.?.A.:.8.9. .1.K.@...O.?.>.=.A.:.0.O.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ru_BY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):132
                                                                                                                            Entropy (8bit):3.60831568269038
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlJFKEUmlulWd9glXliw3swle8vfJ14fn:SvTUo9g1iwp9n0f
                                                                                                                            MD5:CC74A2097053DC548206C81764063E94
                                                                                                                            SHA1:74A461B6439B0C1EBF728D88595953A15CEF968E
                                                                                                                            SHA-256:21AD8327F53E7313F5D10DBDE8387142224D5BC1A19FD83AD620A78463FAB4CD
                                                                                                                            SHA-512:ADC7BBA96E869A725CEB8496FF09DBAD2A8AA0AC28FD193E5D5E45A9637EE1AB5ED1A7EAD812BE4246A9301BEDE9D633F01101E55E84558C9F379B3B1B69DE74
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .1;..........................i~.....S.P...g.S..........`0;.`..g........................ ...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ru_MD.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.276980911276452
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ4lf8t86Uar94IvlllQ/6n:Svzlf8W6xr9Xl46
                                                                                                                            MD5:0828EB96C1B6E0F15F5C95D0564A64AD
                                                                                                                            SHA1:9B72702525956135133A07C4D2B1C1A2BCBBE583
                                                                                                                            SHA-256:B6AFE46C829E2D15754F70FEFC455724BB87335394E9BAEFB6529A50EBA7F0BD
                                                                                                                            SHA-512:F507AAE3DC873E1A49C5D640384187CE01B0508954A315743F3835A65497ECF20234FDC5EEC90FB611A93BC1380372D94317A9B0D6509AEFA03BF0936CC88B66
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..Q....................Q.....i~........Q..w................ ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\rw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):112
                                                                                                                            Entropy (8bit):3.448304786330961
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlVh5tb59VPtjf+lbp4lF7Cfn:Svd9V1Bcf
                                                                                                                            MD5:030FC17C5A0B806EA7CE68877FD66081
                                                                                                                            SHA1:1EDBC17FF5B099F241BCFF57EC4E327D57C2FDD4
                                                                                                                            SHA-256:AFA2AAAABC93D20AE86EED279BAD1C6711264220B072B25825395DB6E0391B41
                                                                                                                            SHA-512:A2434CFCFE52DEA2ABF783F1135BEE0B6B720FEA51379E6F259D346FBA5A43238FC1849B879756C07C7460D5DAA136264790BE6F295E0EAD8521E553E1568D51
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~.................................... ...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\rwk.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):836
                                                                                                                            Entropy (8bit):4.807826091118605
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:mlUNtOaxijlw0+CzJ1WUNxupJLjQXHm3XcfwYXg4YgQYYwS/YgwYYCS9lgAF:mE9i1+wJ1Wuxu/g+M4PHXHCXnCS/gAF
                                                                                                                            MD5:F09BA6EC637887BF827CE42F664D181E
                                                                                                                            SHA1:E8B2FB8468FE264361EC4A788641E06461A94764
                                                                                                                            SHA-256:CD71CE1AFEB8C8186B7EFE0554748EE91D8F1B9CB38F8E7E96BA39BF29594523
                                                                                                                            SHA-512:17A26D4186AAECAE49AE06F9A992580DD3A11A20DB5E22486F2B76A4ED192074CE6911CF920ACA84614EAFE758124C1BC9455282318C07B78CC8783FD8133573
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..j.............:.......U....i~.......ez..........,...z.....~..z....i8.....z..f....j..........n......Z8..b.vz....pT........\.x...&..%..r.!z..*.0T....K8..........$...........@T.....8.... T.....z....~............T....Tz..".......PT.....z..........`T...........z.....T..........................*.......R......z..v.Cz..w.......2z.....z.........`.).`.......`$..`....v..`HJ.`.......`.j.`.......`.<.`.......`.#.`.......`;..`.......`.5.`:.....'.C.G.c.s.w.{...........................+./.;._.c.o.s.{.............................#./.3.;.K.c.k.o...............U...................................X..............."...%...(...+.......1...4...7...:...=...@...C...F...I...L...O...R...[...U...X...[...^...a...d...g...j...m...p...s...v...y...|...^...a...d...........................g...j...................m.. ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sah.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):240
                                                                                                                            Entropy (8bit):4.337546316588306
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvTl//l1vWt2DkThj5vmzU+9/OkDc5YL9LLgbfBF:4HWU6j5vmznOkDEYL9LMbL
                                                                                                                            MD5:3D5B99E8470EC21F627C8453DA480C72
                                                                                                                            SHA1:6F4F2FB089A0565DF90E42AA4F64DC6FC34AED9B
                                                                                                                            SHA-256:27E2AC546C139873EB16767286C90C6027FB935EB50F342C53D2C87B70A263DD
                                                                                                                            SHA-512:D974B040ABFB16B4880EF78AE0DC584CC4FCFF4F0213BEC8B28A9650797642314280F6D0710CBCC8E5D17431973A1F2337E86EA0D1DCBDAD7F30B0777113614D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................,.. ........4...4...........$....i~.....%.(. .4.C.>.;.;.0.@.0.....@.0.A.A.K.K.9.0. .A.>.;.:.C.>.1.0.9.0.............................................o...#...&.......o...,..P/..P............$.. )..P(.. 2..P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\saq.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3184
                                                                                                                            Entropy (8bit):4.009649867978744
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:VpGbUkgX2TBNUH3ZpIYz+7hHqH2H+CGjJvjmnzk5PsJ+4AyHFdIXfVHZPzc6vguL:sUkA2TBKXZpIYz+7hKWeCGjJvjmnI5PR
                                                                                                                            MD5:9D908D79C457772F1210E708881D3352
                                                                                                                            SHA1:B5206B61F24DA701A52FC3C255C0F06ED1D2D257
                                                                                                                            SHA-256:A64389DAA078FB7CFD8544C7FAA53D451ACFD84DC6A09B985442E7B007B02D29
                                                                                                                            SHA-512:CF2EB99E43E6B34C56C51E1628095F60D1BFD07A478EF7603A1DAD4E0BF59E551C901C95DA68114FAC31BC67432E3AB7A02313728AA34B324705EF8C0DCAC11F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..#.............9.....#......i~...D.o.l.a. .e.e.l. .L.i.b.e.r.i.a...P.a.u.n.t. .e.e.l. .S.u.d.a.n.i...D.o.l.a. .e.e.l. .M.a.r.e.k.a.n.i...D.o.l.a. .e.e.l. .Z.i.m.b.a.b.w.e...N.j.i.l.i.n.g.i. .e.e.l. .G.i.n.e...N.j.i.l.i.n.g.i. .e.e.l. .C.h.i.n.a...N.j.i.l.i.n.g.i. .e.e.l. .G.h.a.n.a...N.j.i.l.i.n.g.i. .e.e.l. .I.n.d.i.a...N.j.i.l.i.n.g.i. .e.e.l. .K.e.n.y.a...N.j.i.l.i.n.g.i. .e.e.l. .K.o.n.g.o...N.j.i.l.i.n.g.i. .e.e.l. .L.i.b.y.a...N.j.i.l.i.n.g.i. .e.e.l. .M.i.s.r.i...N.j.i.l.i.n.g.i. .e.e.l. .A.n.g.o.l.a...N.j.i.l.i.n.g.i. .e.e.l. .B.u.k.i.n.i...N.j.i.l.i.n.g.i. .e.e.l. .G.a.m.b.i.a...N.j.i.l.i.n.g.i. .e.e.l. .J.i.b.u.t.i...N.j.i.l.i.n.g.i. .e.e.l. .K.a.n.a.d.a...N.j.i.l.i.n.g.i. .e.e.l. .K.o.m.o.r.o...N.j.i.l.i.n.g.i. .e.e.l. .L.e.s.o.t.o...N.j.i.l.i.n.g.i. .e.e.l. .M.a.l.a.w.i...N.j.i.l.i.n.g.i. .e.e.l. .M.o.r.i.s.i...N.j.i.l.i.n.g.i. .e.e.l. .M.o.r.o.k.o...N.j.i.l.i.n.g.i. .e.e.l. .R.w.a.n.d.a...N.j.i.l.i.n.g.i. .e.e.l. .S.a.u.d.i.a...N.j.i.l.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sd.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9364
                                                                                                                            Entropy (8bit):5.225150716244356
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:2I0H5647jBH3V7R1XtnXo76WD2IZ8siBjaEj+mi9:2HZrBl7R1XVJBjhj+mM
                                                                                                                            MD5:921B49506470F58E8B1B53E2C6286CC4
                                                                                                                            SHA1:4B4E0B6EEC20EFEDA2CE45E3016701DA49B37778
                                                                                                                            SHA-256:FCB3F4F60866BEA6B4034D7412515592F36C58C48F5363CFD6AC21C2690C720A
                                                                                                                            SHA-512:F9ED955871E1AED9DC4B4CA961368DEC822EC494F3DD36FED464A130D1BA8C0DEF033C99055CCDF0CA444D908D61CAF59E058914900D8F8C3B248247EAC374B6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..Q.....................V....i~...*.1...J. .D.1.'...1.H.3.J. .1.(.D...3.4.D.J. .1.~.J...A.,.J. ...'.D.1...~.J.1.H. .3.H.D.....D.J. .~.J.3.H...C.F.P. .A.1.J.F.....'.F...J.F. .1.~.J.../.'.F.4. ...1.H.F...B.7.1.J. .1.J.'.D...J.E.F.J. .1.J.'.D.....'.&.J. .(.'.G.*.....J.F.J. .J.H.".F.....J... ...1.H.F.'.....F.J. .A.1.J.F.....'.1.E.'.F.J. ...1.E...'.D.(.'.F.J. .D.J.....'.....'.*.D. .3...H...(.J.D.J.2. ...'.D.1...,.'.~.'.F.J. .J.J.F...3.9.H./.J. .1.J.'.D...3.H.&.3. .A.1.J.F.....9.E.'.F.J. .1.J.'.D...E.'.D./.J.~. .D.J.H...F.J.~.'.D.J. .1.~.J...G.J.}.J. ...H.1...J...~.H.D.4. .2.D.'.}.J.....J.H.(.F. .~.J.3.H.....J.'.F.'. ...'.D.1...".E.1.J...J. ...'.D.1...'.1./.F.J. ./.J.F.'.1...'.1.H.(.F. .A.D.H.1.F...'.J.1.'.F.J. .1.J.'.D...(.1.'.2.J.D.J. .1.J.D...(.1.E.H./.J. ...'.D.1...*.H.F...F. .~.'.F...'...*...H.F.3. ./...F.'.1...,.(.H.*.J. .A.1.J.F.....3.'.E.H.".F. .}.'.D.'...3.1.(.J.'. ./.J.F.'.1...3.H.E.'.D.J. .4.D.F.....9.1.'.B.J. ./.J.F.'.1...E.5.1.J. .~.'.&.H.F...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sh_BA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.897999040607968
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/dMNl6lLMhk:SBtkJYlU8g8l/d66JGk
                                                                                                                            MD5:8E09780D6328508528DB22AEBEAF32FB
                                                                                                                            SHA1:99B4A5839E27A40B666E7DDF17B390A92B6A5221
                                                                                                                            SHA-256:0E8549291B006F7636CDD4EE7763B91C526C8391BE5A3422873A70D63EFE83A2
                                                                                                                            SHA-512:0AA73AE239A6B5B8FDD5DB3999B5604AD5BA884EAB33F6409CDD7EB7DA8C7BA5B68C913D4BD418F3E97C6110CD19CEB729CE1EBF54E8023F9E09BD5EC54FFCDD
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...s.r._.L.a.t.n._.B.A...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\shi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):912
                                                                                                                            Entropy (8bit):4.994000974815492
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:kOG4+SH+cmjfu16bQVuqkPlE9g+MDLYXHX/KXnUMtv:mSenjf6a7X0gVD03iXU4
                                                                                                                            MD5:3824BCF45CF52B4B40990164AC1B9D03
                                                                                                                            SHA1:4BABA32CCB5DD2900EC77DAC1BA549FF4743F7D7
                                                                                                                            SHA-256:926B62B8568086D42EFAB81199C3C6723921A6D0D67C1FAC1DD9CD68172BFAA3
                                                                                                                            SHA-512:F2DE263C9FEEF45BC9F26CA867DB802A0FF89647CD3AB6E0B7CAE49732400BD1B3A1A6AFEB856FE3A9C566AEC248DEC57580C008671E1A3B330009CDDC9C402A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .*J.............:.......k....i~...S-T-S-..M-I-b-S-O-..<-T-0-O-=- .O- .V-I-O-b-0-..0-7-S-M-0-T- .O- .c-I-N-1-0-1-a-I-.......x....@y...........x..z. y..~.......x.....7..f..x....v7..j......0y..n.]S.....%..b.?......7........&.....r..y..*.......L7....h7.....S.....7...........7....lS....{S....C.....V.....Z7.....S..".............Py.....x...........S.....x.....S.................y.........".....>7..........x..v.....w........x....\..`2..`....v..`)J.`.......`.<.`.......`...`.......`J..`.......`45.`.......`CJ.`:.....'.C.G.c.s.w.{...........................+./.;._.c.o.s.{.............................#./.3.;.K.c.k.o...............+.......1...4...7...:...=...@...C...F...I...L...O...R...U...X...[...k...^...a...d...g...j...m...p...s...v...y...|.......n...........................................................q.......................t...........w...z.......}.............. ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\shi_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2688
                                                                                                                            Entropy (8bit):4.105742011442069
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:BGzsgdTywCf/2DHGdqtA3aPboz+wp21Umtr7F0bCddFr7ogVvXXX3+:ssU+7f/2DGdD3aPboz+waUmtr7F0mdd6
                                                                                                                            MD5:BAB56F22917D77B2E2BD1753D1215932
                                                                                                                            SHA1:D2E6EEE295F388D5ADC950FD5328B9F37D7CBFCF
                                                                                                                            SHA-256:6AC667347A956A659DAF44F6E7D1D08FEF43376734ECADDB8D62DE9532F0858D
                                                                                                                            SHA-512:22030D1FB5E1CB53845C5A9108E90DF4188A99C47BA3C76DA2526F6D6787326DFEEE989B0CC8372A76DC5DCFD8C724384C1A4B60186B9438F272DD6C9729F23D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................:.......;....i~...u.r.u...l.i.y.u.n...l.i.l.a.n.j.i.n.i...f.r.a.n.k. .c.i.f.a...s.i.d.i. .n. .c.a.n.a...a.j.n.i.h. .n. .m.i.c.[...a.d.i.n.a.r. .n. .t.u.n.s...a.r.u.b.i. .n. .l.h.i.n.d...a.r.u.b.i. .n. .m.u.r.i.s...a.y.a.n. .n. .c.c.i.n.w.a...a.y.a.n. .n. .l.y.a.b.a.n...b.i.r. .n. .i.t.y.u.b.y.a...f.r.a.n.k. .n. .k.u.n.g.u...f.r.a.n.k. .n. .q.u.m.u.[...f.r.a.n.k. .n. .c.i.n.y.a...l.u.t.i. .n. .l.i.c.u.m.u...a.c.i.l.i.n. .n. .k.i.n.y.a...a.d.i.n.a.r. .n. .d.z.a.y.r...a.d.i.n.a.r. .n. .l.i.b.y.a...a.d.r.i.m. .n. .l.m.c.r.i.b...a.j.n.i.h. .n. .s.s.u.d.a.n...a.r.u.b.i. .n. .s.s.i.c.i.l...k.w.a.c.a. .n. .m.a.l.a.w.i...a.c.i.l.i.n. .n. .u.c.a.n.d.a...a.c.i.l.i.n. .n. .c.c.u.m.a.l...a.d.i.n.a.r. .n. .b.%.r.a.y.n...a.d.i.n.a.r. .n. .s.s.u.d.a.n...a.d.r.i.m. .n. .l.i.m.a.r.a.t...a.d.u.l.a.r. .n. .k.a.n.a.d.a...a.f.r.a.n.k. .n. .r.w.a.n.d.a...a.f.r.a.n.k. .n. .s.w.i.s.r.a...a.k.w.a.c.a. .n. .z.a.m.b.y.a...d.a.l.a.s.i. .n. .g.a.m.b.y.a...f.r.a.n.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\shi_MA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.8446240823663436
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlgelU8gl8l/dMXltDelOpG:SBtkJZlU8g8l/dMoleG
                                                                                                                            MD5:9107D4EEED5BE9E2DC1199A9DAA9BA61
                                                                                                                            SHA1:42CCE7BB3F740ACCB0114EC93FBB199271B99A45
                                                                                                                            SHA-256:82FEFA4EF189E698F8444D5A2DEF07A8067444321718F521A47CB44D14DE2F92
                                                                                                                            SHA-512:4ACC1BA39FF5F77DE961974E19A204F2B2DED8A4AC932A9BF4262CDA5AD42E96882A75E89B18B77FFB8C18A5ACFEECB6A160310E4B908D05D7EE5DD6D9905D02
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...s.h.i._.T.f.n.g._.M.A.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sk.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):57992
                                                                                                                            Entropy (8bit):4.573804019962586
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:SMchF2PbODZWMWBmMagLKOwFUIOFzI62AYjfRbeKBu6GxFv3U2z4obj4H:CzbZnW5C4tywv3UL
                                                                                                                            MD5:E01C63C31993FD27550D0EDC1A9EF563
                                                                                                                            SHA1:8FC6EF9B0A786C3AF6F965EE17F5AA6BE87E6123
                                                                                                                            SHA-256:8850EF5B32EA979AC3282632FC68EA273FE2558202DD8B4CB7D2DCF44154FE48
                                                                                                                            SHA-512:663E5CDB7F60EC4D7A9566BD6D76676DD018CC6ACFA34755D7F2C9528E9AE051117C8AE6B3C55D0295A4C208406C685792640F047E4AA278AAC298FF62E559A1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB.................8. ..b......8...8........ .&1...i~...S.D.R...N.I.S...p.a.l...d.i.u.m...s.t.r.i.e.b.r.o.....r.s.k.a. .l.i.b.r.a.....i.l.s.k... .p.e.s.o.......n.s.k.y. .j...a.n...C.F.P. .f.r.a.n.k.o.v...f.o.n.d.y. .R.I.N.E.T.....r.s.k.e. .l.i.b.r.y...a.l.b...n.s.k.y. .l.e.k...f...n.s.k.a. .m.a.r.k.a...i.r.a.c.k... .d.i.n...r...i.r...n.s.k.y. .r.i.a.l...m.a.l.t.s.k... .l...r.a...o.m...n.s.k.y. .r.i.a.l...p.o.>.s.k... .z.l.o.t.....r.u.m.u.n.s.k... .l.e.i...s...r.s.k.a. .l.i.b.r.a...t.u.r.e.c.k... .l...r.a...S.A.E. .d.i.r.h.a.m.o.v...f...n.s.k.e. .m.a.r.k.y...m.a.l.t.s.k... .l...r.y...n.e.z.n...m.a. .m.e.n.a...p.o.>.s.k... .z.l.o.t.....s...r.s.k.e. .l.i.b.r.y...t.u.r.e.c.k... .l...r.y.....r.s.k.e.j. .l.i.b.r.y.....i.l.s.k... .p.e.s.o.s.......n.s.k.e. .j...a.n.y...a.r.m...n.s.k.y. .d.r.a.m...b.u.l.h.a.r.s.k... .l.e.v...d...n.s.k.a. .k.o.r.u.n.a...e.t.i...p.s.k.y. .b.i.r.r...i.n.d.i.c.k... .r.u.p.i.a...j.e.m.e.n.s.k... .r.i.a.l...k.a.t.a.r.s.k... .r.i.a.l...k.e.n.s.k... .a.i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sr_Cyrl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9159246284584364
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMe/ut6E7l+Vbr+0mli:Sv6t6gYbrlmli
                                                                                                                            MD5:1960AD3959332481F6D916F056B52339
                                                                                                                            SHA1:CEA9C67AFC66F20E4104CB6AA2DF781BCCADFD5A
                                                                                                                            SHA-256:DCB5A6234F2F38BECE4039140F59EA549C5CEF8191CDA68FDAE9D5B6106D9B4F
                                                                                                                            SHA-512:C7BE9FB55877D5418AFB221F94F131E02A2C88C55216E2A1B9967B3DDE70B47336D8878B97CB64228A7DDDA55DC4665517F1F8E8DF2B997E2895AFE62F9A3986
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sr_Latn_ME.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.463875210299606
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/xr+yhll:SBtkJ1li6gml/xrjJ
                                                                                                                            MD5:C64F71AE20060954B9E32C5B9DA51C65
                                                                                                                            SHA1:1E33967C51E09874F6A1DE9A9C3539DB9CA82A63
                                                                                                                            SHA-256:1F132CA885D786C508137E5A798DCA175FDD0D486A134931FCC3803DB934B735
                                                                                                                            SHA-512:CAAAD60303A93E38E881D7FC3C711D7A52ACB59511A65BEE549193067F88B870BFF2DAEBDDFAE6D4ED366F93D3D7003EC5B0AC13890B9187F9A37D2BE8831D17
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sr_RS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9486907468225554
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMLs06E7lA5r+uh2vn:Svz06gA5r/gvn
                                                                                                                            MD5:A1A03E4AE0BB3120DAA7F925F9754736
                                                                                                                            SHA1:244855F29A028C974B0E908CD8E4CEE11F65E56C
                                                                                                                            SHA-256:FD67C6594B5413B30F3D04973480904EC2179107B767666C37A8A55C90918EA6
                                                                                                                            SHA-512:04C5B3FFB40B64422F94929E0181879CB7DE1E8D07D5B2C59ACA1E5E88A33503BA3A6E377C064C5675D0522C49F6853BD28E5141B9227846336F2686D551E987
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sr_XK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.897999040607968
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/dMNl6lSU5Wul/kB:SBtkJYlU8g8l/d66/5WutkB
                                                                                                                            MD5:AD95203D99A7C8F9EDD9D394D1CBB580
                                                                                                                            SHA1:9E28470FEAA13EAF13FE2EE15CDE3355CCFBB39B
                                                                                                                            SHA-256:BE427B86712AAD38000658279D1EB25EAF9BE9D839A97EC6143E8E9723B01E87
                                                                                                                            SHA-512:9D94B0CA833F5CC51C76B0394A4F3247AE282BBDFA1849F8E3536548955AF53DF80D24C3F34E97D1FAD9C17914FF81C1760848126138E65150719AD6E763187F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...s.r._.C.y.r.l._.X.K...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sr_YU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9486907468225554
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMLs06E7lA5r+uh2vn:Svz06gA5r/gvn
                                                                                                                            MD5:A1A03E4AE0BB3120DAA7F925F9754736
                                                                                                                            SHA1:244855F29A028C974B0E908CD8E4CEE11F65E56C
                                                                                                                            SHA-256:FD67C6594B5413B30F3D04973480904EC2179107B767666C37A8A55C90918EA6
                                                                                                                            SHA-512:04C5B3FFB40B64422F94929E0181879CB7DE1E8D07D5B2C59ACA1E5E88A33503BA3A6E377C064C5675D0522C49F6853BD28E5141B9227846336F2686D551E987
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\supplementalData.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):26920
                                                                                                                            Entropy (8bit):4.708110350588715
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:gk3OXcntoryTGQoa1nrQLqKAqRW3/m/CDk7YUc5mWS/pkd/r/vkKLS3wVj3Xa:B3J10ARj3lJhja
                                                                                                                            MD5:E2AB6E00B6A485A7CDA52810DFB62104
                                                                                                                            SHA1:3A1B801B57C16C3DB75805DD8B7B4BCF82C097C2
                                                                                                                            SHA-256:CB7FA7CF7365FBC9B967D89B70217EFC61A1AF5E8506166F279FAD06E5F632BD
                                                                                                                            SHA-512:20958C1364A04B060558E9C34C3586F7D3483C1DD05CBD2F6DB11D20A2D1FB8596BAC3181B2AF752014936FA71D7AE9D344AEA2E68B6ADA0F794913E55E569A2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................>.. ........B...B...............CurrencyMap.AC.from.id.to.AE.AG.AI.AL.AM.AO.AQ.AR.AS.AT.AU.AW.AX.AZ.BA.BB.BD.BE.BF.BG.BH.BI.BJ.BL.BM.BN.BO.BQ.BR.BS.BT.BU.BV.BW.BY.BZ.CA.CC.CD.CF.CG.CH.CI.CK.CL.CM.CN.CO.CP.CR.CS.CU.CV.CW.CX.CY.CZ.DD.DE.DG.DJ.DK.DM.DO.DZ.EA.EC.EE.EG.EH.ES.ET.EU.FI.FJ.FK.FM.FO.FR.GB.GD.GE.GG.GH.GI.GL.GM.GN.GP.GQ.GR.GS.GT.GU.GW.GY.HK.HM.HN.HR.HT.HU.IC.ID.IE.IL.IM.IN.IO.IQ.IR.IS.IT.JE.JM.JO.JP.KE.KG.KH.KI.KM.KN.KP.KW.KY.KZ.LA.LB.LC.LI.LK.LR.LS.LU.LV.LY.MA.MC.ME.MG.MH.ML.MN.MO.MP.MQ.MS.MT.MU.MV.MW.MX.MY.MZ.NA.NC.NE.NG.NI.NL.NO.NP.NR.NU.NZ.OM.PA.PE.PG.PH.PK.PL.PM.PN.PR.PS.PT.QA.RE.RS.RU.SA.SB.SC.SE.SG.SH.SI.SJ.SL.SM.SN.SO.SR.SS.ST.SU.SV.SX.SY.SZ.TA.TC.TF.TG.TH.TJ.TK.TM.TN.TO.TP.TR.TT.TV.TW.TZ.UA.UG.UM.US.tender.UY.UZ.VA.VC.VE.VG.VI.VN.VU.WS.XK.YE.YT.YU.ZA.ZM.ZR.ZW.ZZ.CurrencyMeta.ADP.AFN.ALL.AMD.BHD.BIF.BYN.BYR.CAD.CHF.CLF.CLP.COP.CRC.CZK.DEFAULT.DJF.DKK.ESP.GNF.GYD.HUF.IDR.IQD.IRR.ISK.ITL.JOD.JPY.KMF.KPW.KRW.KWD.LAK.LBP.LUF.LYD.MGA.MGF.MMK.MNT

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20696
                                                                                                                            Entropy (8bit):4.281117984299618
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:d968do9Rh2/kHr5C00gT50gNDl74TJ+qNe3r676aHHO:IKgNh4JBJU
                                                                                                                            MD5:D067C8CE3452D85AD93C2F10BA372D81
                                                                                                                            SHA1:13330649673116449AB65AEC08A4DA8E3DEEBE26
                                                                                                                            SHA-256:14982A5C5EE07293DCBD3DA536B20CFC2BBB7BDC0B88912D38100A59E5B43EC0
                                                                                                                            SHA-512:E4A5BF0CE83ADD26E89A9ED41642BD8C62DFCD0AAE43896633303D440AA13E832C870BD982F00313A981312BB260C8C11A3D2CCCEDBAC0B9D1A138596D8058DF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................$.. ..j..........................i~...S.o.l. .y.a. .P.e.r.u...S.o.l. .z.a. .P.e.r.u...P.e.s.o. .y.a. .C.u.b.a...D.o.l.a. .y.a. .F.i.j.i...K.i.p. .y.a. .L.a.o.s.i...P.e.s.o. .z.a. .C.u.b.a...R.i.a.l. .y.a. .I.r.a.n...d.o.l.a. .y.a. .F.i.j.i...d.o.l.a. .z.a. .F.i.j.i...k.i.p. .y.a. .L.a.o.s.i...k.i.p. .z.a. .L.a.o.s.i...r.i.a.l. .y.a. .I.r.a.n...r.i.a.l. .z.a. .I.r.a.n...P.e.s.o. .y.a. .C.h.i.l.e...r.i.a.l. .y.a. .Q.a.t.a.r...D.i.n.a.r. .y.a. .I.r.a.q...P.e.s.o. .z.a. .C.h.i.l.e...R.i.a.l. .y.a. .O.m.a.n.i...R.i.a.l. .y.a. .Q.a.t.a.r...R.i.a.l. .y.a. .Y.e.m.e.n...T.a.l.a. .y.a. .S.a.m.o.a...c.e.d.i. .y.a. .G.h.a.n.a...c.e.d.i. .z.a. .G.h.a.n.a...d.i.n.a.r. .y.a. .I.r.a.q...d.i.n.a.r. .z.a. .I.r.a.q...r.i.a.l. .y.a. .O.m.a.n.i...r.i.a.l. .y.a. .Y.e.m.e.n...r.i.a.l. .z.a. .O.m.a.n.i...r.i.a.l. .z.a. .Y.e.m.e.n...t.a.l.a. .y.a. .S.a.m.o.a...t.a.l.a. .z.a. .S.a.m.o.a...D.o.l.a. .y.a. .G.u.y.a.n.a...R.e.a.l. .y.a. .B.r.a.z.i.l...D.o.l.a. .y.a. .B.e.l.i.z.e...D.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\sw_UG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.272176235559989
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQC2l/88tuq5r9VUillQ/6n:SvJC/88Iyr9546
                                                                                                                            MD5:F7CC579D402A7319CC4673C12D1317ED
                                                                                                                            SHA1:193ECB9B1A3A797CDFD31A8734F34E0D7D747D72
                                                                                                                            SHA-256:34648DAE797C375677666B965AE5701BBE64C6E1242C13D7F1E3CE0CFEE8EBA9
                                                                                                                            SHA-512:1D822DD38EB48000D2F196DA8DB6DF77EC4491FAD52DB53CC1E159B5853AAC5A7759A4611D2D19BFD19343202AB7D4E62C3E37A205CBA42BDE05CDB3F1C7B365
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .S....................S......i~.....B.R...k................ ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ta.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17184
                                                                                                                            Entropy (8bit):4.686950440861322
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:gg6mRRdJebKkyOVIUvy5QF24rNLw/snW19CDKj2/TLmXWf:ddusfMKjOLd
                                                                                                                            MD5:9F553ACCE6CEAD76C65B70125AC45AB0
                                                                                                                            SHA1:72D47638F170575C63C74B88F52DB732BB978F93
                                                                                                                            SHA-256:0105681B01A06828ACD598DCF8B267C12E1A7F5FD6398C256B7CF66B0F2FBE2D
                                                                                                                            SHA-512:3A1304C6315759E169D32F6750AA4E3A451B3F0CB312DB1F2139BCAFA1513A573BD2C0804DEC8E955D309056BBA4C72BC678A6DF70A9FC648263AD70A0E49FAC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~..................... ..................................... ....................... ........................... ......................... ..................... ............................. ..................... ............................. ....................... ......................... ............................. ............... ........... ....................... ............................. ........................... ......................... ........................... ............................. ......................... ............................... ....................... ............................... ............................. ........................... ............................. ................................. ........................... ............................... ........................... ............................... ........................... ........................... .....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\ta_SG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):124
                                                                                                                            Entropy (8bit):3.5980244129747705
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tluMmvn95lWhiTCkznwOt/V/+Fn:Sv7mvn95l+iTCkLwOt9/+F
                                                                                                                            MD5:169F2FF7D98CB2A54449E789069B9A06
                                                                                                                            SHA1:5513F0CE09DE00CAEAA0050967FDE6477A670F38
                                                                                                                            SHA-256:5B658B61B81993EC1F7D12FAAF2DA0A165B72E8ACA451C57C2A5441955D95DD0
                                                                                                                            SHA-512:C666A467DD062CC22442AA4D42BB18DE3A22E794D203EF15B9E3026560244726871BC0B57E7765A0FD9CD301A64CFDF67C3A466F6BAE779D385018EA1360F134
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...................NS......o........................ ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\tg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):904
                                                                                                                            Entropy (8bit):4.60945162615726
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:5bAWyfWyci/eihnaMLqKHzFaMXMB7milLDL4lln4EfDkKVL2bUvvzrz2GTjnHXsF:hAT1/damNc0+NX4X4ukY2Azrz2GTr8F
                                                                                                                            MD5:2F40F00FA94A048A0CE73AA75C55B2DA
                                                                                                                            SHA1:B879C9C4FC85A2AB99A54203CE6D657F5340114E
                                                                                                                            SHA-256:5BCB82754164C667256BAF6AF1D6037ECDCDB2DAEAE4B7BCAD44C271DCC148B4
                                                                                                                            SHA-512:B9F69C43765F9AA3295D213CA0D507C70DD742504DF841EC00BC98C4F4BB55E5D11A7E049D4E512D2E3103E4A07F0F3E3FDB9289976159C9BBEE1EAD30ECBFDE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...A.>.<.....!.>.<.>.=..... .C.1.;.8. .@.C.A.....@.C.1.;.8. .@.C.A.......>.;.;.0.@.8. ...........5.=.0.8. .E.8.B.>.......5.=.0.8. .O.?.>.=.....4.>.;.;.0.@.8. .........8.5.=.0.8. .E.8.B.>.....8.5.=.0.8. .O.?.>.=.......A.J.>.@.8. .=.>.<.0.J.;.C.<... .5.0.;.8. .1.@.0.7.8.;.8.O.3.....@.5.0.;.8. .1.@.0.7.8.;.8.O.3.....(.0.A.J.>.@.8. .=.>.<.0.J.;.C.<.)... .C.?.8.O.8. ...8.=.4.C.A.B.>.=.....@.C.?.8.O.8. ...8.=.4.C.A.B.>.=.....$.C.=.B. .A.B.5.@.;.8.=.3.8. .1.@.8.B.0.=.....D.C.=.B. .A.B.5.@.;.8.=.3.8. .1.@.8.B.0.=.........................\.c.....?.................................W.........+...o.......\...............................z.....Q.............................-...........W.........+...C.o...............................................W.........+...C.o.....0..P3..P6..P9..P<..P?..PB..PE..PH..PK..P............... ...P... N..P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\th_TH_TRADITIONAL.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):2.9886793699589003
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtldelFal9lcmdk/9Y4V:SBtkJUlY8md+B
                                                                                                                            MD5:85CEE841BDC8B2D3A0B6544576DBEAD7
                                                                                                                            SHA1:05C1647984FB86E890697B162A14E86D77506A9E
                                                                                                                            SHA-256:2C2D2E70731EE8D8A596F4DAAE3C37AFDBDA3E1D4749C1CAE3CC0A0F089457BE
                                                                                                                            SHA-512:80E6371924D1358C1CE7698E9EE1242E1B1121D48C00CCED521D0E60ABF4F62BF6D2BFFB15039DB7C0C335BA0A0BCF39A59C23AFE591BC95220ACF20572096A1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~...b.u.d.d.h.i.s.t.....S.......J....P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\tl_PH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):92
                                                                                                                            Entropy (8bit):2.768295007707197
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlF112lYlilljXZl916:SBtkJclIil9XZl9s
                                                                                                                            MD5:4A961CCB7DD7A06BCD13A045A1B5A1E4
                                                                                                                            SHA1:7F4A21794BE6C657423B6A14995EB9CB9700B788
                                                                                                                            SHA-256:06919C5A4235F272011337486F6316740FC36D66C1966EE60961B5FF2592E04A
                                                                                                                            SHA-512:F232D010796C3F65C9B1DF10CE98DB4EF4CAC6D91F74388A13EF6F009372C5043D7D602F72D380F71E00E1FF6C03571BDA9CB800D55257DBF50975E6CE5C9019
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...f.i.l._.P.H...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\tr.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25244
                                                                                                                            Entropy (8bit):4.889800301143363
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:LJsomVIGBnJGp2F3JPKEow0+GJuWYT+XI4CBPiI75Of:LJsomVIGBnJGp2F3J1ow0+Gmi44Sb9Of
                                                                                                                            MD5:B4769B615A8F5D94CAC4D9EE8B305ABB
                                                                                                                            SHA1:3BE922C8EC92D36E7B9CB4B036F45F8D981F7896
                                                                                                                            SHA-256:4AB0B84C8AF30FC853A97B267A24022E5458C58F643F4CDEDF90EFF2FE0EEF63
                                                                                                                            SHA-512:2C6E390F46EFB9D1F5CDE00E10C013F0B97D299D77D1AD5512AD332CE11FE2B09FC4DC2F513F88B5464C94BDC6DC66F9DA54348F6CE99DC10A3305CE6701EC36
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..b...................K.....i~...A.l.t.1.n...G...m..._...P.a.l.a.d.y.u.m...P.e.r.u. .0.n.t.i...P.e.r.u. .s.o.l.....P.e.r.u. .S.o.l.....W.I.R. .A.v.r.o.s.u...W.I.R. .F.r.a.n.g.1...A.B.D. .d.o.l.a.r.1...C.F.P. .f.r.a.n.g.1...J.a.p.o.n. .y.e.n.i...R.o.m.e.n. .l.e.y.i...A.B.D. .D.o.l.a.r.1...C.F.P. .F.r.a.n.g.1...F.a.s. .F.r.a.n.g.1...J.a.p.o.n. .Y.e.n.i...B.u.r.m.a. .K.y.a.t.1...F.a.s. .d.i.r.h.e.m.i...F.i.j.i. .d.o.l.a.r.1...G.i.n.e. .f.r.a.n.g.1...H.a.i.t.i. .g.u.r.d.u...I.r.a.k. .d.i.n.a.r.1...R.u.s. .r.u.b.l.e.s.i...S.1.r.p. .d.i.n.a.r.1...T...r.k. .l.i.r.a.s.1...0.r.a.n. .r.i.y.a.l.i...^.i.l.i. .p.e.s.o.s.u...F.a.s. .D.i.r.h.e.m.i...F.i.j.i. .D.o.l.a.r.1...G.a.n.a. .S.e.d.i.s.i...G.i.n.e. .F.r.a.n.g.1...G.i.n.e. .S.y.l.i.s.i...H.a.i.t.i. .G.u.r.d.u...I.r.a.k. .D.i.n.a.r.1...M.a.l.i. .F.r.a.n.g.1...R.u.s. .R.u.b.l.e.s.i...S.1.r.p. .D.i.n.a.r.1...0.r.a.n. .R.i.y.a.l.i...^.i.l.i. .P.e.s.o.s.u...F.i.n. .M.a.r.k.k.a.s.1...M.a.l.t.a. .L.i.r.a.s.1...Y.e.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\uz_AF.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.917999040607968
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/dKSlH3s0S:SBtkJYlU8g8l/d/d3s0S
                                                                                                                            MD5:DDBF4F267F436E5B2BF36BA490D37A57
                                                                                                                            SHA1:AAFBD9B971C2E02CB86BB9789AD00C3128E54084
                                                                                                                            SHA-256:FD7452416A9A0690CCC83D32596EAFC58C9F279402582FD2934F81D4D1DF69FB
                                                                                                                            SHA-512:044BE61439C98901029DC0F8BCC246396E6E836D35E6DEB26ED34B190EBAD43FC1C3A9FFD522E9AB86A29A07A1A5C573C80099BEFED69B3EF739FCD946B2482B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...u.z._.A.r.a.b._.A.F...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\uz_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9159246284584364
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMe/ut6E7l+Vbr+0mli:Sv6t6gYbrlmli
                                                                                                                            MD5:1960AD3959332481F6D916F056B52339
                                                                                                                            SHA1:CEA9C67AFC66F20E4104CB6AA2DF781BCCADFD5A
                                                                                                                            SHA-256:DCB5A6234F2F38BECE4039140F59EA549C5CEF8191CDA68FDAE9D5B6106D9B4F
                                                                                                                            SHA-512:C7BE9FB55877D5418AFB221F94F131E02A2C88C55216E2A1B9967B3DDE70B47336D8878B97CB64228A7DDDA55DC4665517F1F8E8DF2B997E2895AFE62F9A3986
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\vun.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):836
                                                                                                                            Entropy (8bit):4.807826091118605
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:mlUNtOaxijlw0+CzJ1WUNxupJLjQXHm3XcfwYXg4YgQYYwS/YgwYYCS9lgAF:mE9i1+wJ1Wuxu/g+M4PHXHCXnCS/gAF
                                                                                                                            MD5:F09BA6EC637887BF827CE42F664D181E
                                                                                                                            SHA1:E8B2FB8468FE264361EC4A788641E06461A94764
                                                                                                                            SHA-256:CD71CE1AFEB8C8186B7EFE0554748EE91D8F1B9CB38F8E7E96BA39BF29594523
                                                                                                                            SHA-512:17A26D4186AAECAE49AE06F9A992580DD3A11A20DB5E22486F2B76A4ED192074CE6911CF920ACA84614EAFE758124C1BC9455282318C07B78CC8783FD8133573
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..j.............:.......U....i~.......ez..........,...z.....~..z....i8.....z..f....j..........n......Z8..b.vz....pT........\.x...&..%..r.!z..*.0T....K8..........$...........@T.....8.... T.....z....~............T....Tz..".......PT.....z..........`T...........z.....T..........................*.......R......z..v.Cz..w.......2z.....z.........`.).`.......`$..`....v..`HJ.`.......`.j.`.......`.<.`.......`.#.`.......`;..`.......`.5.`:.....'.C.G.c.s.w.{...........................+./.;._.c.o.s.{.............................#./.3.;.K.c.k.o...............U...................................X..............."...%...(...+.......1...4...7...:...=...@...C...F...I...L...O...R...[...U...X...[...^...a...d...g...j...m...p...s...v...y...|...^...a...d...........................g...j...................m.. ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\wae.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):584
                                                                                                                            Entropy (8bit):4.407512034023909
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:blmebAeeQMe4OCtqFNwuL8iJmRWiJXbR8TM0Ftavt7uNcsCSFz:bLAQ7rKR9R8o03avBuNcsC2z
                                                                                                                            MD5:A8EE52CBA875B8C8E3CE9AC7FE4B8180
                                                                                                                            SHA1:8C8CA9D1DDEF698405887FA0386CED852F5E528A
                                                                                                                            SHA-256:C73552857FB89A29804AD6684FAEA24FFC6301C4A55D039DEE0D6A878A139EC1
                                                                                                                            SHA-512:F0D266D850F7AC7023707759463FAAACE788CB407A76B3EDA5FEAB72275AB86DE7855674630C811F5342AC46A8904A8A3EF7F675A3F0EA3D75552A1CE18A1E1B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .2....................2.g....i~...I.n.d.i.a.i. .R.u.p.i.e...I.n.d.i.a... .R.u.p.i.e...C.h.i.n.e.s.i.a.i. .Y.u.a.n...C.h.i.n.e.s.i.a... .Y.u.a.n...U.n.b.e.k.a.n.n.t.i. .W...r.i.g...B.r.a.s.i.l.i.a.n.i.a.i. .R.e.a.l...B.r.a.s.i.l.i.a.n.i.a... .R.e.a.l.......|.....M.....h...\.._....3...........1......X....k.........|.......\.M.......h.h........_._......@.3.................1.1........X.X......k.k...............W.........+...o...n...q...t...w...z...}.................W.........+...o......P...P...P...P...P...P...P...P...P............g.. u.. ...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\xog.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1892
                                                                                                                            Entropy (8bit):4.384562017949789
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:nYSLiPgL11tOOaIRiq31vQcolFDow2T+5QsgV3zb:nYSLiPgL15DRiPZopDTV3zb
                                                                                                                            MD5:B89B57691C731C580E4B2597F2016B73
                                                                                                                            SHA1:8BE9AF989ED73CB75497C3EC31E4D06D1F13D475
                                                                                                                            SHA-256:04A7133D4591A127D31C2C411B2B3AB0602E3CC1DC612D2F729C497928604A6F
                                                                                                                            SHA-512:E0D20BFBDD093454B95126A70936F678871B987CA3E43BEF6F93A55764E04261AA5F92603506B5F56844729B4FAC5BB31C9526C8C453F438AC1406708F3BFE25
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .sl.............9.......D....i~...L.e.w.o.n.e...L.o.t.i. .y.a. .L.e.s.o.s.o...Y.e.n.i. .y.a. .J.a.p.a.n.i...D.o.o.l.a. .y.a. .K.a.n.a.d.a...F.a.r.a.n.g.a. .y.a. .G.i.n.i...K.w.a.n.z.a. .y.. A.n.g.o.l.a...B.i.i.r.u. .y.a. .E.s.y.o.p.y.a...D.a.l.a.s.i. .y.a. .G.a.m.b.y.a...D.i.n.a.a.l.i. .y.a. .L.i.b.y.a...D.o.o.l.a. .y.a. .L.i.b.e.r.y.a...P.a.w.u.n.d.a. .y.a. .M.i.s.i.r.i...P.u.l.a. .y.a. .B.o.t.i.s.w.a.n.a...R.u.p.i.y.a. .y.a. .B.u.y.i.n.d.i...D.i.n.a.a.l.i. .y.. A.l.i.g.e.r.y.a...F.a.r.a.n.g.a. .y.a. .J.j.i.b.u.t.i...F.a.r.a.n.g.a. .y.a. .b.u.r.u.n.d.i...D.i.n.a.a.l.i. .y.a. .B.a.a.r.e.e.n.i...N.a.k.i.f.a. .y.a. .E.r.i.t.u.r.e.y.a...P.a.w.u.n.d.a. .e.y.. e.S.u.d.a.a.n.i...D.o.o.l.a. .y.. A.w.u.s.i.t.u.r.e.l.y.a...P.a.w.u.n.d.a. .y.a. .B.u.n.g.e.r.e.z.a...E.s.i.k.u.d.o. .y.a. .K.e.e.p.u. .V.e.r.e.d.i...P.a.w.u.n.d.a. .e.y.. e.S.e.n.t.i. .H.e.r.e.n.a...Y.u.w.a.n.i. .R.e.n.i.m.i.n.i.b.i. .y.a. .C.a.y.i.n.a...F.a.r.a.n.g.a. .y.a.m.u. .A.f.i.r.i.k.a. .y.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\yi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):988
                                                                                                                            Entropy (8bit):4.654054242383244
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:c5eYEblPclOJE1kO/hE+RnZDcCpH4GLFXo:4+uyjO/h1RZwW4Ko
                                                                                                                            MD5:F4AABC6B23D3BD25C09A1BBDEC63B447
                                                                                                                            SHA1:BFA3FE017BC6580327DA5929CCC8A9FF4F77E942
                                                                                                                            SHA-256:5E8CA212EB5698FD2F6B6AE266B3000B0EF0606C52CEADF3461C34E9D9AF13BE
                                                                                                                            SHA-512:2577B047A299EB21F0F4D6335FFEFB594FF65DA7FDF2616617BF6E8B8935F3D6610A10FA7F4AC3B1D619625CDE5311980D69A14BB251AD7CDB7E8CD3505ED048
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .............................i~................................................... ....................... ......................... ......................... ..................... ........................... ............................. ........................... ..................... ..................................... ............................... ......................... ................................... ............................. ............................. ..................................... ......................................... ...........................z.....f.h...............\.............G.........:.8.....W...........................+...o...\.................................................................G.).................W.y.............W.o.{.........+.....o.+./.........................!...$...'...*...-...0...3...6...9.....W.........+...o...I..PN..PS..PX..P]..Pb..Pg..Pl..Pq..P............... <..P... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\yue_CN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.8446240823663436
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlgelU8gl8l/dGKlAl6lazlI/kx:SBtkJZlU8g8l/dDal6leGkx
                                                                                                                            MD5:75B011D02D63B77CA0C21C3F35552109
                                                                                                                            SHA1:2D1B0EC3BD811D1D74B726036BAF731F4E9C9194
                                                                                                                            SHA-256:A564B942279C3F05AC249F7148F6C925C5199A10DFF6702F57C97965A2247D7E
                                                                                                                            SHA-512:061B71932A3020B9030EB5C291F30E87683110FA75E7CF6496C398609104A1F95E82670DFF8AB5763510D1A1D3C07A4258FC296C6F9C66A6F8BDD800F4DE272C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...y.u.e._.H.a.n.s._.C.N.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\yue_Hans.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):11548
                                                                                                                            Entropy (8bit):6.226808663836252
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:ZigKAq6pJZ5trcj5R7l5ONwmJafT0U9e44smg9jBIO9d7PtjBIT9vucU8/e:Z6Aq6pn5tuR7lSarAXgJBI4dDZBIZGam
                                                                                                                            MD5:C8B81F557142DCCBFEA41269A57B46AC
                                                                                                                            SHA1:30F512E952A3A529337E96458E14E6F050583C40
                                                                                                                            SHA-256:96A3637E9931BC81A4EE48B0591641C2B02D153F538D66807E13A6996EDB03D6
                                                                                                                            SHA-512:36647204FD31D6E64D5390CA1872BBF8907D239174E7D5C312CFDE04BA3AAE3128B49BCC4CB00695B0141A1E72736A0326D9EDB63A592857D5DE31FF079E724F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................4.. ..b.....?...?................i~............R.^...e.W..'kCQ...l.../n.^...o.^..}v....Q.......WS..W...S..W..WS..W..pS<\.v...W.SQ....eNmCQ...e.S.^..vl..CQ...o.CQ....8uCQ..w.pQ.v...e.9NQ....N.RXo.R..9N..KQ.g...Nr..RQ....Q.\KQ.g...R.g.l...WS.9NQ...WS^.pQyr..pS.^bS.k...S)R.NQ...-W.N..CQ...[.V.Wnf...].Tl.CQ...]...YCQ..._.Vl.KQ...e.RaW.^...l.V.l...1r.\pQQ...YrpN.RCQ..~vUa...^...y...V.....~..pQ.^....pQl.KQ...)RWSCQ...T.bS.^......eCQ...~^X0W..l..\.NQ...l...l.....].ZQ...*g.w'..^...N..\g.t.V...N9N..yr&O..IN'Y)R..b..LNr^..HQ.N..LN.b-W.b"}..TN.l.N.b....O.g..N.\...Q.Q.N.l....Q.Q.N.....aS....N.\..bS.[...l...bS.h!X.l....S.,{.~.\...S...N.\..#Wk..R.bQ...TX.TKQbS.^..^X-^.\bS.k..eY0W)RHQ.N...[.T.b.[Nb..<\.l.\bS.k...].g,{.~.\..._.f...\CQ..id.\.Y.t8R..id\g.N.R.O..id.~.T.l....g.W.[^t.\..<h^t....CQ...k)R.e.l....l.V..l....lpQyQW..c..yr.k.c>kCg...rP[q\)R.f...s)R.~.N.....v.^W.@.Q....yidW..l....y..*Y3..^...zv..[yrW....~.e,{.~.\...~s|.k.NCQ....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\zh_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.948690746822556
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM0E/66E7lXr+uhL:SvO/66gXr/N
                                                                                                                            MD5:26EA16780F22AEE7F9C7214AE43A2112
                                                                                                                            SHA1:7B1B1CB9DA311A503EF14177139AD5E19F569A01
                                                                                                                            SHA-256:4CF80C1BEB6035861DB18C3E0EE97998B37948A3087B9D3984B19517E5567749
                                                                                                                            SHA-512:CB3FAA598B8862EED58EAE2874666D58E161B9A5559D47BE9618F5744FA4DC38E56C8FF9A75D9E49D00611D19C5AAE558D087D3C91D61D60917EFD18050629E9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.#....................#......i~.......".

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\zh_MO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.937999040607968
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/dFZRysr:SBtkJYlU8g8l/dFZv
                                                                                                                            MD5:9646047BCCEACAEAB2803D2396A9C46D
                                                                                                                            SHA1:FA843E3E3DEDE95B251AE0858A52C2C1773D28F0
                                                                                                                            SHA-256:41176DB75B4AA71856B7284865D41DD2C37DD8FEFF838DEC665F4B29D2915BEB
                                                                                                                            SHA-512:A3786F18538D2080E2FE5C8C0E6675C33B8A958D59520B0A0B62E737B258E5A0AFB3453B4C9DB100226FFA3AAB178427C979B8E6F5ED4EA2EE3CBC58509CE594
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.............................i~...z.h._.H.a.n.t._.M.O...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\da_DK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXEl0t6E7lFEKe:SvKM0t6gCKe
                                                                                                                            MD5:CF788FA9793FEA6104E904FBA48B9ADE
                                                                                                                            SHA1:5105A53F269A6C445FE58F0AB7BB501BF5790960
                                                                                                                            SHA-256:D49D36962528CD70E638FE62C2A675838D5F6D13C229F6A107530D58C458D100
                                                                                                                            SHA-512:B07CED3B04E2CE33B0FA215AE03002E666D5408F31ADE8FE84F46E2A7474D277B40887F090D5DB6ABEA58B6A8DF385F952DD614979AD903AAF31B524A06AA93B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\de.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):19332
                                                                                                                            Entropy (8bit):5.419925826094204
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:BCH7yddL0RIuwGjIaE89EGh2hupscziGV5UzhxKUyShhpCSMx9UGauBrKeS:BCH7yL/uwGUzBhuphz5exHyShhaxmGXi
                                                                                                                            MD5:7F2F2773D81477A2BA2DC5334E418CC1
                                                                                                                            SHA1:490CD01A6D1A2B249BE2EDD25BF649C9DF09C72C
                                                                                                                            SHA-256:28990FB74EE58F9136E37FD097DB00A50A662FD8791AEBBD4677C74DA34AC1A8
                                                                                                                            SHA-512:5D0508B329D13E227D52038208F1599EC05FC0573E55132CE814398B0868E0CF9E6D44339E72A9F30DC2909E2EC29D2705D56D616E45474BB425DA122296B1B9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................V................A.w...D.i...S.o...W.T...D...i...O.r.t...T./.J...W./.M...T.o.b.i.....s.a.r...l.Y.r.r...A.f.f.e...F.r.a.u...H.a.h.n...H.a.s.e...H.e.r.z...H.u.n.d...K.a.n.a...M.a.n.n...T.i.e.r...P.a.o.n.i...P.a.o.p.i...T.h.o.u.t...$.a.m.l.e...*.Y.d.a.r...A.b.e.n.d...N.a.c.h.t...h.e.u.t.e...I.j.j.a.r...S.i.w.a.n...V.o.r.m.....N.a.t.u.r...P.f.e.r.d...R.a.t.t.e...S.e.p.t.....S.p.o.r.t...T.a.s.t.e...Z.i.e.g.e...j.e.t.z.t...G.Y.n.b.o.t...H.a.t.h.o.r...M.e.s.o.r.i...T.a.+.[.a.[...l.Y.q.Y.m.t...M.i.t.t.a.g...M.o.r.g.e.n...a.b.e.n.d.s...n.a.c.h.t.s...K.i.s.l.e.w...N.a.c.h.m.....T.a.m.m.u.s...n.a.c.h.m.....A.n.d.e.r.e...B...f.f.e.l...D.r.a.c.h.e...F.l.a.g.g.e...K...r.p.e.r...P.e.r.s.o.n...P.f.e.i.l.e...R.e.i.s.e.n...S.m.i.l.e.y...W.e.t.t.e.r...Z.e.i.t.z.....A.s.h.a.d.h.a...C.h.o.r.d...d...E.s.s.f.a.n.d...M.e.s.c.h.i.r...V.a.g.u.m.e.n...m.o.r.g.e.n.s...S.c.h.e.v.a.t...T.i.s.c.h.r.i...F.l.a.g.g.e.n...G.e.b...u.d.e...G.e.p.a.a.r.t...O.b.j.e.k.t.e.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\de_CH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):588
                                                                                                                            Entropy (8bit):4.57320275301365
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:oXEfyl2CBXlU+pjxrUxXlU05p4wP8TppiPPUotr8oVs0:oXuRaOkxAxOUP83iPcAIG
                                                                                                                            MD5:E670379BAD562D53F6C9D9E05A7EE576
                                                                                                                            SHA1:4960472CE76A72BB21E0A03D0E3CD15685FAF82D
                                                                                                                            SHA-256:837DC87AEB9BDC01B18DDE833EF23D10AA2406491CED00BFC4EA47F8FFAD8B8B
                                                                                                                            SHA-512:5C586A977B20DE758210770FFB935DAD159BE32D8CF51EBE0B31A3DCCA844D65A6A1C898FF1725495B460290A7F7F62B572FD4464AA4813FF4C86600F0E74C40
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................\........D.i...S.o...T.a.g. .d... .J.....W.o... .i... .M.....W... .i... .M.o.n.....W.o.c.h.e. .i.m. .M.o.n.a.t...W.o.c.h.e.n.t... .i... .M.o.....W.o.c.h.e.n.t... .i... .M.o.n.....W.o.c.h.e.n.t.a.g. .i.m. .M.o.n.a.t.........y......................T.Ts#.Q................H..s.b....*..................%....Z.....I.....9.........H.!.W.C.M..B..........i..Pn..P....\.. ..!.s.......b.. ....d.. ..`.f.. .......P....>...........'.6.L...{..P~..Pj.. ...P...P...P...P...P...P...P..O.......W.|.. ....[...o.w...D....`...``.. ...`h.. l.. ~..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\de_DE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXEl0t6E7lFEKe:SvKM0t6gCKe
                                                                                                                            MD5:CF788FA9793FEA6104E904FBA48B9ADE
                                                                                                                            SHA1:5105A53F269A6C445FE58F0AB7BB501BF5790960
                                                                                                                            SHA-256:D49D36962528CD70E638FE62C2A675838D5F6D13C229F6A107530D58C458D100
                                                                                                                            SHA-512:B07CED3B04E2CE33B0FA215AE03002E666D5408F31ADE8FE84F46E2A7474D277B40887F090D5DB6ABEA58B6A8DF385F952DD614979AD903AAF31B524A06AA93B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\dje_NE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\dsb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10024
                                                                                                                            Entropy (8bit):5.547764666835321
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:ctlyalAJEBJMInGA64W/H5q3aiAlt0VV50dg5QyL4pkbB6HTWlp1+:crWP5/9thQQDelp8
                                                                                                                            MD5:B3F6199FDE5D1E86BD090D721D01C041
                                                                                                                            SHA1:812E437F5F438312739F106D0B4A7C74D61937C5
                                                                                                                            SHA-256:B2CE4567252D640C2B266DB61A85F1C9DF924E45EDDCC334FAB7C94D93BF542A
                                                                                                                            SHA-512:15167646D16A155B878020507C8C1C06FF7B9BEE0BCB8936CE629F6FC2A6C09523D39B601AF47A72D0E4B823548A3A810CE6FDD3464DBDB3CE521362CB5031E7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................1...............n.j...p.....p.....s.r...p...n...p...t...s.o.b...s.r.j...s.t.w...w.a.B...a.w.g...m...r...a.w.g.....c.o.r.a...m.a.j.....m.a.j.a...m...r.....m...r.c...n.o.w.....B.o.n.i...a.p.r.y.l...m...r.c.a...w.i.t.[.e...w...t.p.....z.n.o.w.a...z.i.n.s.a...s.r.j.o.d.a...a.p.r.y.l.a...e.p.o.c.h.a...g...z.i.n.a...j.u.l.i.j.a...j.u.n.i.j.a...l...t.o.s.a...t.o. .p.......t.u. .n.j.....t.u. .s.o.....t.u. .s.r.....t.u. .w.a.....n.j.e.z.e.l.a...w.a.B.t.o.r.a...a.w.g.u.s.t.a...j.a.n.u.a.r.a...o.k.t.o.b.r.a...t.e.n. .p.......t.e.n. .s.t.....t.u. .n.j.e.....t.u. .s.o.b.....t.u. .s.r.j.....z.a. .{.0.}. .z...z.a. .{.0.}. .g...z.a. .{.0.}. .m...'.z.e.g.'... .H...a.m.e.r.i.s.k.i...b.r.i.t.i.s.k.i...f.e.b.r.u.a.r.a...m.e.t.r.i.s.k.i...n.o.w.e.m.b.e.r...n.o.w.e.m.b.r.a...t.e.n. .p...t.....t.e.n. .p...t.k...t.e.n. .s.t.w.....t.o. .p...n.j.....t.u. .w.a.B.t.....p.[...n...l...c.....p... .C.h.r...n.....p.[...C.h.r...n.....t.e.n. .t.y.z.e.D...t.u. .s.r.j.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\dua.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2172
                                                                                                                            Entropy (8bit):5.152976967217277
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:s3ASPkvcjdXeM82L8hGwQeyYalIGMhmVbWpFVkme:sXKidXebJvyDlVXdW7I
                                                                                                                            MD5:D30165FDE0C4929AE82A4BD11846D1AA
                                                                                                                            SHA1:D0E4AB8445DA08A0E7FEBD99C8BCBB09DDFB9091
                                                                                                                            SHA-256:5C0DCF5801B243528806DF4E40B332712CE4FA79C7D8FA656B808CE7C7F8B62D
                                                                                                                            SHA-512:2480C3C355F9EDE0093E42E38C9C34F6423B1BF74E97046CD0EA95F8353734A694C399FA33232A7520AC99D6C8659146293F1AE6B822176595A24FAE7157A503
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................................W.....t...s.T.K...d.i.K...d.i.S...e.l.....e.m.i...e.s.a...e.s.T...k.w.a...m.a.d...m.b.....m.u.k.....t.i...K.g.i...W...n...m.T...s...n.y.[.t...n.d.u.1...n.d.u.2...n.d.u.3...n.d.u.4...s.T.K.[...K.g.T.n...S...Y.s...i.d.i.S.a...k.w.a.s.....k...[.l.[...m.b...Y.s...m.T...s.....n.d.T.k.T...p...n.d.....p...n.d.....K.g.i.s.....e.b.y...m.u...d.i.S...S.....t.i.n...n.....K.g.a.n.d.[...K.g.T.n.d.[...W...n.[.s.....d.i.m.T...d.i...e.l...K.g.[.....e.s.a.S.a.s.....m.a.y...s.[.....m.u.k.T...s.....n.y.[.t.[.k.i...w.[...K.g.[.....d.i.K.g.i.n.d.i...e.m.i.a.s.e.l.e...e.s.T.p.[.s.T.p.[...[.h. .q. .v. .x. .z.]...m.a.d.i.S.[...d...S.[.....e.p.a.s.i. .a. .b...n.y.....k...[.l.[. .n...t...m.b.......m...n.y... .m... .d.i.s.a.m.a...n.d...m.b.k. .n.y... .S.o.s.....S.o.s.o. .S.w... .y...S.e. .l.....m.b...s.a. .k.w...d.i. .a. .Y...s...n.d...m.b.k. .n... .l...n.d.[... ...S.a.....n.d...m.b.k. .n... .l...n.d.[... ...l...l.o...n.d...m.b.k. .n... .l...n.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\dyo_SN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ee.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10376
                                                                                                                            Entropy (8bit):5.1589056607368
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:QWCjUNAvEMlKNZgsaHq8EWktI55Ha2aJ761id7lYl1:BCQNpDaK8E/toHD1GlQ1
                                                                                                                            MD5:43924655E6FE7A25523653D0B54F7BD6
                                                                                                                            SHA1:4403ED81E4633A7D4086F4C3DFDA9635DD9ECAF5
                                                                                                                            SHA-256:90E119321C04C1E8849149CB409F38C9022072D8AAD4974E68629FA9B2B90CE7
                                                                                                                            SHA-512:326B7BA34792B96E87327C72F0706F150134E2EA76B4F4A3F2AE1F278F6EE947FCB317A30130471C46A574EB338A9481A2C179B545A90159ABA7F661A7FFF60F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................/.......)........c...z.......e...B.K...E.K...k.1...k.2...k.3...k.4...Y.K...u.k...K.d.i...f.i.....K.d.T...k.T.s...b.l.a...d.z.o...f.i.V...k.u.V...m.e.m...y.a.w...a.f.T...a.n.y...d.a.m...d.e.a...d.z.d...d.z.m...d.z.v...k.e.l...m.a.s...t.e.d...........m.n.n...k.u.V.a...k.T.t.a...d.a.m.a...f.i.V.a...k.e.l.e...m.a.s.a...e.g.b.e...f.i.f.i...c.e.t.r.T...f.T.K.l.i...c.l.e.t.i...b.l.a.V.a...d.z.o.m.e...d.z.o.v.e...d.z.o.V.a...a.f.T.f.).e...a.k.p.e. .0...d.z.o.d.z.e...k.T.s.i.V.a...t.e.d.o.x.e...y.a.w.o.V.a...s.e.k.e.n.d...{.0.}.l.i.a.....e. .s.i.a...s.i.a.m.l.T.m...a.k.p.e. .0.0...a.n.y.T.n.y.T...m.e.m.l.e.V.a...a. .'.g.a.'. .h...a.k.p.e. .0.0.0...b.i.l.i.T.n. .0...m.i.l.i.T.n. .0...f.i.V.a. .s.i.a...k.u.V.a. .s.i.a...0. .t.r.i.l.i.T.n...b.i.l.i.T.n. .0.0...m.i.l.i.T.n. .0.0...c.l.e.t.i. .s.i.a...Y.e.s.u. .K.T.l.i...a.V.a.b.a...o...o...b.l.a.V.a. .s.i.a...d.z.o.V.a. .s.i.a...K.k.e.k.e.a. .m.e...b.i.l.i.T.n. .0.0.0...d.e.a.s.i.a.m.i.m.e...k.T.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\el_CY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXEl0t6E7lFEKe:SvKM0t6gCKe
                                                                                                                            MD5:CF788FA9793FEA6104E904FBA48B9ADE
                                                                                                                            SHA1:5105A53F269A6C445FE58F0AB7BB501BF5790960
                                                                                                                            SHA-256:D49D36962528CD70E638FE62C2A675838D5F6D13C229F6A107530D58C458D100
                                                                                                                            SHA-512:B07CED3B04E2CE33B0FA215AE03002E666D5408F31ADE8FE84F46E2A7474D277B40887F090D5DB6ABEA58B6A8DF385F952DD614979AD903AAF31B524A06AA93B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_001.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3412
                                                                                                                            Entropy (8bit):5.584446588534467
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:Hg0uiTualeUQgHi2rp+Ff1oNmck+lV9YL9r:Hg0uiT1AxNDcF98r
                                                                                                                            MD5:3FEC1D99E7260B742A5FE169CF298877
                                                                                                                            SHA1:909CAC90785875A4815C9FB0C9B09CD1180919C3
                                                                                                                            SHA-256:49765DE09FBCD1BF53A893F6509FF2EF0884D7CCBC6077915B0DF38D336DD179
                                                                                                                            SHA-512:C4D496CC65E80F9B578451E241D25FE47B80D35BFA3459361A00EB99606283309ACFA974AEB619BA4219840B7CFE93CCE6473038A9FBB29AB9A6F6FCBB61272C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................H.. ........M...M... .......$........w.k. .o.f. .m.o...l.a.s.t. .F.r.i...l.a.s.t. .M.o.n...l.a.s.t. .S.a.t...l.a.s.t. .S.u.n...l.a.s.t. .T.h.u...l.a.s.t. .T.u.e...l.a.s.t. .W.e.d...n.e.x.t. .F.r.i...n.e.x.t. .M.o.n...n.e.x.t. .S.a.t...n.e.x.t. .S.u.n...n.e.x.t. .T.h.u...n.e.x.t. .T.u.e...n.e.x.t. .W.e.d...t.h.i.s. .F.r.i...t.h.i.s. .M.o.n...t.h.i.s. .S.a.t...t.h.i.s. .S.u.n...t.h.i.s. .T.h.u...t.h.i.s. .T.u.e...t.h.i.s. .W.e.d...i.n. .{.0.}. .w.k...i.n. .{.0.}. .y.r...i.n. .{.0.}. .h.r...i.n. .{.0.}. .m.o...d.a.y. .o.f. .w.k...d.a.y. .o.f. .y.r...i.n. .{.0.}. .m.i.n...i.n. .{.0.}. .s.e.c...{.0.}. .h.r. .a.g.o...{.0.}. .m.o. .a.g.o...{.0.}. .w.k. .a.g.o...{.0.}. .y.r. .a.g.o...{.0.}. .m.i.n. .a.g.o...{.0.}. .s.e.c. .a.g.o...w.k.d.a.y. .o.f. .m.o...{.0.}. .F.r.i. .a.g.o...{.0.}. .M.o.n. .a.g.o...{.0.}. .S.a.t. .a.g.o...{.0.}. .S.u.n. .a.g.o...{.0.}. .T.h.u. .a.g.o...{.0.}. .T.u.e. .a.g.o...{.0.}. .W.e.d. .a.g.o......h.B7w.3E.K....,...B.B..................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_AE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):960
                                                                                                                            Entropy (8bit):5.757935503161978
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:Ns6sVBu5RklU8DaUDkHcgkFGDjuMSGt9f:+RVBu5AU8eUQ8VGDifu9f
                                                                                                                            MD5:74DA98DDF2F132C0276E5E05A7EC5824
                                                                                                                            SHA1:1B8FFBC90C4E6ABCD36C222C9C4447EBF6BB3916
                                                                                                                            SHA-256:F380F07C082FB6D5CC4034BB096A6100B076BC7C6FBD809E44D55EEF4765DE25
                                                                                                                            SHA-512:E56B4E82D0B3BCA0770D47016710DCA56FD3A4B986696170657B4DFAB74FEE9D2C75D0A2073DFDBAF4D9192442E82E626BFAE9A6C496A417E6240E325A6BC535
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...................................h.B7w.3E.K....,...B.B......................!..... ...........!..V..?....C..4.4D....,.,.,.V...,....$.......$./.LO....$...v.....$.lNlN..............$...8.8.8.....$...?.........$....q.=.....$..........h.B7w.3.wEy.......B.B....................................!............&...DJ..4!....Cpi..?..N.C..4.4..{.pi........$.......$./.LO....$...v.....$.lNlN..............$...n.n.n.....$......a.....$.....zN.....$............h.B7w.3.wW*eh.....B.B........................W.!......... ....D!.pi.....C..4.4.4.)...eh......$.......$./.LO....$...v.....$.lNlN..............$...8.8.8.....$.............$.....N......$................!......... .2..P7..P<..PA..PF..PK..PR..PY..P`..P......5........P... ........!......... ....P...P...P...P...P...P...P...P...P......5.g...u..P... ........!......... ....P...P...P...P...P...P$..P+..P2..P......5........P... ......`.... ... ... ..o.w...f$.`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_AG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXElzxlf6tP9hn:SvKMH6tX
                                                                                                                            MD5:DBED6CBF5B4E215E7BC058594652C5C6
                                                                                                                            SHA1:14FF2242EB58DED4AE8DA0315F21AD1894CC848D
                                                                                                                            SHA-256:DF819C5400D36259BCA9E3F7FBDAFB6F2DA2FFA00C5CF03695D3A1A5A20E8592
                                                                                                                            SHA-512:0312DC0174E32ABA5FDC8EDC21D06DD613F0BC9BB24E1E502902379B997406D4B5E2A0C17E48BF582594C5D0988FA8DD3FD9A1CCC9FC386C4E453683196F2EC8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_AS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXEl0t6E7lFEKe:SvKM0t6gCKe
                                                                                                                            MD5:CF788FA9793FEA6104E904FBA48B9ADE
                                                                                                                            SHA1:5105A53F269A6C445FE58F0AB7BB501BF5790960
                                                                                                                            SHA-256:D49D36962528CD70E638FE62C2A675838D5F6D13C229F6A107530D58C458D100
                                                                                                                            SHA-512:B07CED3B04E2CE33B0FA215AE03002E666D5408F31ADE8FE84F46E2A7474D277B40887F090D5DB6ABEA58B6A8DF385F952DD614979AD903AAF31B524A06AA93B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_AU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2468
                                                                                                                            Entropy (8bit):5.602184732072754
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:Y4cP2obFaRzrvhr5tcvpZ7Fzrbb+IWdoz6oSw+:Y9tU99yPbbiq+oI
                                                                                                                            MD5:6AFBCEAB26E9CDB7A0C3978067D715EA
                                                                                                                            SHA1:157A048D6EED10EC0B881D98025FFAE2A741D565
                                                                                                                            SHA-256:919F775692A2A75954C984F924CD13957534C8C3093B662641634D1A8B9B3556
                                                                                                                            SHA-512:17F287355174E167333397B21ED5894E8994333EA3CAE26689AF10F2C49351390AEC6387CF58ABD06314872946127B19A94176B2E63F3EF4C7E0BC8823C95E79
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................T.. ........a...a...........E........F.....T.h...T.u...W.....S.u.....T.h.....T.u.....M.o.1...M.o.2...M.o.3...M.o.4...M.o.5...M.o.6...M.o.7...M.o.8...M.o.9...[..!]...m.i.d.d.a.y...a.t. .n.i.g.h.t...w.k. .o.f. .m.o.....i.n. .{.0.}. .h.r.s...i.n. .{.0.}. .w.k.s...i.n. .{.0.}. .y.r.s...i.n. .{.0.}. .m.i.n.s...i.n. .{.0.}. .s.e.c.s...{.0.}. .h.r.s. .a.g.o...{.0.}. .w.k.s. .a.g.o...{.0.}. .y.r.s. .a.g.o...{.0.}. .m.i.n.s. .a.g.o...{.0.}. .s.e.c.s. .a.g.o...w.k.d.a.y. .o.f. .m.o.........3...........W.s...z.^.................!.%.).-.1.".'.,...P<>Id=.HD<L=.V.H.<X=2a.W.... ........$..h.h....$.......$............h.B7w.3.wW*ehc....B.B........!..N......:.........V....\........q.l,....:.........V....\........q.l,............/.T|.c^..ca.9............./.T|.c^..ca.9............./.M|.c^..c@.9.../.9.../.9.../.9...=.1.5.M.a.E.A...I...9.I..... ......1.B.|......."...L..b...c....>.?...Z....H...f...4...J..:....J..9.9....J.2F2F..J.S...J.....J.S...J.......J..7t.....J..F......

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_CK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):136
                                                                                                                            Entropy (8bit):4.168303237889532
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlkAll/tXl7ggOZMCyP98Dn8n8UltslulflFWSkf:SvUA/bXOyxP98j8nxltVTFif
                                                                                                                            MD5:8E8F7836852A74DE789DD0F4C71797DB
                                                                                                                            SHA1:7509333C6D134B2BAD48486057F91336DC1AA009
                                                                                                                            SHA-256:D338E130FAFE30C63A1DDE8B6478A23DCE8D1A3716B776C44FBF9E132A392C32
                                                                                                                            SHA-512:4C39DD6462EA0F1F0D674BB06E8A5153A86903A91B0C04166A06C7DF3B511E6CE83CBFE19D7175C010867F97DCB80723C398B4985D68BA162C30DD15B52D1FD9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...................................k..)...4.wW*eh.....B.B................`.... ....o.w....`...`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_CY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXElzxlf6tP9hn:SvKMH6tX
                                                                                                                            MD5:DBED6CBF5B4E215E7BC058594652C5C6
                                                                                                                            SHA1:14FF2242EB58DED4AE8DA0315F21AD1894CC848D
                                                                                                                            SHA-256:DF819C5400D36259BCA9E3F7FBDAFB6F2DA2FFA00C5CF03695D3A1A5A20E8592
                                                                                                                            SHA-512:0312DC0174E32ABA5FDC8EDC21D06DD613F0BC9BB24E1E502902379B997406D4B5E2A0C17E48BF582594C5D0988FA8DD3FD9A1CCC9FC386C4E453683196F2EC8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_DK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):324
                                                                                                                            Entropy (8bit):5.179858701245657
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvC/seapWsuikw/t1FbQ0dv3t4bwT8j8n7k0dv3t4PqhUG/AOKtklh/F:jcWPiVF1FM0dv9g2w0dv9CTGYOjlh/F
                                                                                                                            MD5:4ABA537E3FDD9E3F6905F9B5960B211A
                                                                                                                            SHA1:E376900C0F2416AF7F87387049E06494BD9B22DD
                                                                                                                            SHA-256:934557876DE04EFF7088A7176872A60AEDDDD4AA8623473BCE50F0E784E0BEE9
                                                                                                                            SHA-512:6F8A125D0827DFC2005C94663BED3C3DACF9498B76CF72208E85C8BC0FF4A6F63AC495388F6ED3B729CB27C4733446F5883B9FD0F8FBD1879F15B262A337FE12
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................B.. ........I...I...........2.............)......../.NN..'...................I.......Y.0.*..*X..5.7.*.*.P!7.5.5[PVB...OJ*.*.7.wW*eh.....B.B....................I.......Y.0.*..*X..5.7.*.*.P!7.5.5[PVB.............P...P....2.. .......P........(...6..P....`...8.. :.. ......o.w......`6.. ...`>..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_DM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXElzxlf6tP9hn:SvKMH6tX
                                                                                                                            MD5:DBED6CBF5B4E215E7BC058594652C5C6
                                                                                                                            SHA1:14FF2242EB58DED4AE8DA0315F21AD1894CC848D
                                                                                                                            SHA-256:DF819C5400D36259BCA9E3F7FBDAFB6F2DA2FFA00C5CF03695D3A1A5A20E8592
                                                                                                                            SHA-512:0312DC0174E32ABA5FDC8EDC21D06DD613F0BC9BB24E1E502902379B997406D4B5E2A0C17E48BF582594C5D0988FA8DD3FD9A1CCC9FC386C4E453683196F2EC8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_GD.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXElzxlf6tP9hn:SvKMH6tX
                                                                                                                            MD5:DBED6CBF5B4E215E7BC058594652C5C6
                                                                                                                            SHA1:14FF2242EB58DED4AE8DA0315F21AD1894CC848D
                                                                                                                            SHA-256:DF819C5400D36259BCA9E3F7FBDAFB6F2DA2FFA00C5CF03695D3A1A5A20E8592
                                                                                                                            SHA-512:0312DC0174E32ABA5FDC8EDC21D06DD613F0BC9BB24E1E502902379B997406D4B5E2A0C17E48BF582594C5D0988FA8DD3FD9A1CCC9FC386C4E453683196F2EC8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_GH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXElzxlf6tP9hn:SvKMH6tX
                                                                                                                            MD5:DBED6CBF5B4E215E7BC058594652C5C6
                                                                                                                            SHA1:14FF2242EB58DED4AE8DA0315F21AD1894CC848D
                                                                                                                            SHA-256:DF819C5400D36259BCA9E3F7FBDAFB6F2DA2FFA00C5CF03695D3A1A5A20E8592
                                                                                                                            SHA-512:0312DC0174E32ABA5FDC8EDC21D06DD613F0BC9BB24E1E502902379B997406D4B5E2A0C17E48BF582594C5D0988FA8DD3FD9A1CCC9FC386C4E453683196F2EC8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_GI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):136
                                                                                                                            Entropy (8bit):4.168303237889532
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlkAll/tXl7ggOZMCyP98Dn8n8UltslulflFWSkf:SvUA/bXOyxP98j8nxltVTFif
                                                                                                                            MD5:8E8F7836852A74DE789DD0F4C71797DB
                                                                                                                            SHA1:7509333C6D134B2BAD48486057F91336DC1AA009
                                                                                                                            SHA-256:D338E130FAFE30C63A1DDE8B6478A23DCE8D1A3716B776C44FBF9E132A392C32
                                                                                                                            SHA-512:4C39DD6462EA0F1F0D674BB06E8A5153A86903A91B0C04166A06C7DF3B511E6CE83CBFE19D7175C010867F97DCB80723C398B4985D68BA162C30DD15B52D1FD9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...................................k..)...4.wW*eh.....B.B................`.... ....o.w....`...`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_IE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):380
                                                                                                                            Entropy (8bit):5.237337917003197
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:Sv5A3R71Oy8Z8j8nR6Dhl8MWjdlQ/fQIyB9aaD1j8nj21/oaW2fnOWxY1Nl2Tuzq:uQ7Ey+8j20Dohlz71DR2q1/fOWxgNlY3
                                                                                                                            MD5:CC4B528BFCE9E4180F75444B2ABC9D14
                                                                                                                            SHA1:812E4AEC36C4F1FBF9E16679ECA725139D7C3BB2
                                                                                                                            SHA-256:C50BC11E7BDA0553223F4F956DC09173CA9503EEB94048F8721A6E034BC7D2BA
                                                                                                                            SHA-512:B794303A40FD964AFFF66FFC104BCC2E0E18ACC262F88E3393B20AACFF3A8B0297F4CF0C17162F11AE01598BDEFAE8EBD59F992386CCE9462E409AFA4D451417
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................R.. ........W...W...........7..........k..)...4mhEy.......B.B......!.........../.ZT.......O.O....$...K.K.K.....$...a..#.....$...I.I.I......*..k..)...4.MW*eh.....B.B........!..... ..N..h./..4....$.............$...i.}k.......... ......P...P$..P+..P......5........P7.. ........N..PU..P..j.....5...2...5...C..PC.. ....`...>.. G.. ....o.w....`...`N..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_IM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):136
                                                                                                                            Entropy (8bit):4.168303237889532
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlkAll/tXl7ggOZMCyP98Dn8n8UltslulflFWSkf:SvUA/bXOyxP98j8nxltVTFif
                                                                                                                            MD5:8E8F7836852A74DE789DD0F4C71797DB
                                                                                                                            SHA1:7509333C6D134B2BAD48486057F91336DC1AA009
                                                                                                                            SHA-256:D338E130FAFE30C63A1DDE8B6478A23DCE8D1A3716B776C44FBF9E132A392C32
                                                                                                                            SHA-512:4C39DD6462EA0F1F0D674BB06E8A5153A86903A91B0C04166A06C7DF3B511E6CE83CBFE19D7175C010867F97DCB80723C398B4985D68BA162C30DD15B52D1FD9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...................................k..)...4.wW*eh.....B.B................`.... ....o.w....`...`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1040
                                                                                                                            Entropy (8bit):5.538748446700931
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:pReIRC05Ov1HzrN6ek321B0PIkow5i0nsL:zBRC0Qv1HzrN6ek321B0gzwrnsL
                                                                                                                            MD5:3DC62D10E5638341A3F7D392339D392C
                                                                                                                            SHA1:2D129C7F37674F1F6E4C757230A424A02873C38E
                                                                                                                            SHA-256:1B5B2B5EB2BC70EF7BE580394069714A4EFE2E5DFC1B91A26302A8A1DB66DE01
                                                                                                                            SHA-512:569396073B2523538B1A3F69B023F05CDAA7F65B8F8D491A0BADA5E95182D58CC302F446C3960E178425728E1902AE4D5424DAF9D55F999405D0558E08BAFA55
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .6....................6...........0.L.....0.0.L.....0.C.r.....0.0.C.r.....0.L.C.r.....0.T.C.r.....0.0.0.C.r.....0.0.L.C.r.....0.0.T.C.r.....0.0.0.L.C.r...2...1...4.9...1.4...d./.M./.y./. .G.G.G.G.G.......7...vO.B......J.U.U.....J.........J.7.7.....J.;.;.....J.@.@.....J.E.E.....J.W.W.....J.Q.Q.....J.e.e.....J.K.K.....J.^.^.....J.l.l....h.B7w.3u....C~....B.B............!..................y.C...\R...y...CZT....$.........$....j....$.b.b........O.O....$...5.5.5.....$...a..#.....$...I.I.I....h.B7w.3.iW*n.8....B.B.................. .J..4...Ch..^.4....$.........$....j...h.B7w.3mh...)~....B.B............!..................y.C...\...y...CZT..35..!*K5{5CC...*.)y*Pk@k...........D....E.P.V.].e.n.x.............\..Pa..Pf..Pk..Pp..Pu..Pz..P...P...P...P...P...P....... ........U..P... ....... ......!....... ....P...P...P...P...P...P...P......5........P... ...........P...P......5........P... ....2.......... ......H........P... ....`...... ... ... ....?..P..4.B..P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_LC.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXElzxlf6tP9hn:SvKMH6tX
                                                                                                                            MD5:DBED6CBF5B4E215E7BC058594652C5C6
                                                                                                                            SHA1:14FF2242EB58DED4AE8DA0315F21AD1894CC848D
                                                                                                                            SHA-256:DF819C5400D36259BCA9E3F7FBDAFB6F2DA2FFA00C5CF03695D3A1A5A20E8592
                                                                                                                            SHA-512:0312DC0174E32ABA5FDC8EDC21D06DD613F0BC9BB24E1E502902379B997406D4B5E2A0C17E48BF582594C5D0988FA8DD3FD9A1CCC9FC386C4E453683196F2EC8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_MH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXEl0t6E7lFEKe:SvKM0t6gCKe
                                                                                                                            MD5:CF788FA9793FEA6104E904FBA48B9ADE
                                                                                                                            SHA1:5105A53F269A6C445FE58F0AB7BB501BF5790960
                                                                                                                            SHA-256:D49D36962528CD70E638FE62C2A675838D5F6D13C229F6A107530D58C458D100
                                                                                                                            SHA-512:B07CED3B04E2CE33B0FA215AE03002E666D5408F31ADE8FE84F46E2A7474D277B40887F090D5DB6ABEA58B6A8DF385F952DD614979AD903AAF31B524A06AA93B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_MT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):224
                                                                                                                            Entropy (8bit):4.7322474492350795
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvzJOy/Ca8nVNH4NCuj8nVb5Kt8Mqfg+p0Ffn:WAyaa2VUh2Vb0ttoght
                                                                                                                            MD5:5D7C90813EC91CAE25B29B5E02A72AF7
                                                                                                                            SHA1:8A20CF947002A414D246D0E1FC3716A88260E9F9
                                                                                                                            SHA-256:A14CD0E7BECE613DB790919136940C447991C40C1BF626DA792D360F12B30D5A
                                                                                                                            SHA-512:402B5E8C0161DC4D5DFAD4FA270F0CCBC190DB73B461633ED5D8FF36F672317D384D01E22898DD853086C590EEA31A48B93E0F8070792C9647207593A3702833
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................+.. ........0...0......................k..)...4.wDyuP.....B.B............E ..uP..k..)...4.w.y.5.....B.B............E ]..5.................P............$..P....`...... #.. ....o.w....`...`'..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_NA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQpxlzJstP9hj:SvfJstz
                                                                                                                            MD5:84781FB37996AE5ED3C3E0E3BEB4455A
                                                                                                                            SHA1:ECD887370A4453E67A642A46BEF4BB4593C0CEDD
                                                                                                                            SHA-256:B94B6BAE10B1B207ADFB721F38C9BDABF1B3619C2C82AFE24C7A0F823F9CA38E
                                                                                                                            SHA-512:FFFC82BE344ACDAFA125A7A9BA3D79939F695B3C8A1AA66D8C0092847B7487385C979175F37D7DF39EB3334F56621DF78D3B2B087E7AE5D40972DD37ED42B109
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_PW.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQpxlzJstP9hj:SvfJstz
                                                                                                                            MD5:84781FB37996AE5ED3C3E0E3BEB4455A
                                                                                                                            SHA1:ECD887370A4453E67A642A46BEF4BB4593C0CEDD
                                                                                                                            SHA-256:B94B6BAE10B1B207ADFB721F38C9BDABF1B3619C2C82AFE24C7A0F823F9CA38E
                                                                                                                            SHA-512:FFFC82BE344ACDAFA125A7A9BA3D79939F695B3C8A1AA66D8C0092847B7487385C979175F37D7DF39EB3334F56621DF78D3B2B087E7AE5D40972DD37ED42B109
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_SD.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQpxlzJstP9hj:SvfJstz
                                                                                                                            MD5:84781FB37996AE5ED3C3E0E3BEB4455A
                                                                                                                            SHA1:ECD887370A4453E67A642A46BEF4BB4593C0CEDD
                                                                                                                            SHA-256:B94B6BAE10B1B207ADFB721F38C9BDABF1B3619C2C82AFE24C7A0F823F9CA38E
                                                                                                                            SHA-512:FFFC82BE344ACDAFA125A7A9BA3D79939F695B3C8A1AA66D8C0092847B7487385C979175F37D7DF39EB3334F56621DF78D3B2B087E7AE5D40972DD37ED42B109
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_SG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):844
                                                                                                                            Entropy (8bit):4.992526813261028
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:F6/kXVvq3/CUwFN2hLneL9xkl0oJsQC1NIgjf:RVS3qUk2hW9U/yFf
                                                                                                                            MD5:148368AC58E622FF8C24F0A9F1E72712
                                                                                                                            SHA1:FF7ED58F8363C5852D661E5D4D78F0E876DD3BA0
                                                                                                                            SHA-256:5F4C811D317284CE9189258AC4FD0C7BBB810717BC8FEBC45F0D2E9322D9BF19
                                                                                                                            SHA-512:0300C955FF9452225D734EEA66E46E95CC10148301B889169ADA4BD2170940E8868B10992E8F3833426E8A8587B96EAE43FCEDCA92E3EC6E4E2A81D525C07A76
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................................l.a.s.t. .w.k...l.a.s.t. .y.r...n.e.x.t. .w.k...n.e.x.t. .y.r...t.h.i.s. .w.k...t.h.i.s. .y.r...l.a.s.t. .m.t.h...l.a.s.t. .q.t.r...n.e.x.t. .m.t.h...n.e.x.t. .q.t.r...t.h.i.s. .m.t.h...t.h.i.s. .q.t.r...i.n. .{.0.}. .m.t.h...{.0.}. .m.t.h. .a.g.o......h.B7w.3.wEy..3C...B.B........R.....$..h.h....$.........$........$.......$....h.h.h...h.B7w.3.wW*ehc....B.B........$..h.h....$.........$.........$.......$.............H.............J.........J.........H.............J....>....J.c`.K....H...........H.................. ....P...P...P...P...P......5.~......P... .......... ....P...P...P...P...P....5.......... ....`...... ... ...........P...P...........`...P... ...........P...P...........P... .......P.......P........r...... ... ... ... ....o.w........`...`... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_SX.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):136
                                                                                                                            Entropy (8bit):4.168303237889532
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlkAll/tXl7ggOZMCyP98Dn8n8UltslulflFWf:SvUA/bXOyxP98j8nxltVTFu
                                                                                                                            MD5:9195559CD1C871889BAE26AD19CA0C24
                                                                                                                            SHA1:7106DB267CC6F7D978D00D4A9829010B1E653375
                                                                                                                            SHA-256:AB6683282CD7CD5A8A819796FF415A8C97933EB2A77E5F6B8B42048DD336EB70
                                                                                                                            SHA-512:231CFF0AE144AF4382B9F869807492ECE979A809F0F4A912B8B41E09EBF4CC6F173EC62A507AF72C28BF825A7F74624B1AB776F293D632038E7B3590C9B885C5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...................................k..)...4.wW*eh.....B.B................`.... ....o.w....`...`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_TO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQpxlzJstP9hj:SvfJstz
                                                                                                                            MD5:84781FB37996AE5ED3C3E0E3BEB4455A
                                                                                                                            SHA1:ECD887370A4453E67A642A46BEF4BB4593C0CEDD
                                                                                                                            SHA-256:B94B6BAE10B1B207ADFB721F38C9BDABF1B3619C2C82AFE24C7A0F823F9CA38E
                                                                                                                            SHA-512:FFFC82BE344ACDAFA125A7A9BA3D79939F695B3C8A1AA66D8C0092847B7487385C979175F37D7DF39EB3334F56621DF78D3B2B087E7AE5D40972DD37ED42B109
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_TZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):136
                                                                                                                            Entropy (8bit):4.168303237889532
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlkAll/tXl7ggOZMCyP98Dn8n8UltslulflFWf:SvUA/bXOyxP98j8nxltVTFu
                                                                                                                            MD5:9195559CD1C871889BAE26AD19CA0C24
                                                                                                                            SHA1:7106DB267CC6F7D978D00D4A9829010B1E653375
                                                                                                                            SHA-256:AB6683282CD7CD5A8A819796FF415A8C97933EB2A77E5F6B8B42048DD336EB70
                                                                                                                            SHA-512:231CFF0AE144AF4382B9F869807492ECE979A809F0F4A912B8B41E09EBF4CC6F173EC62A507AF72C28BF825A7F74624B1AB776F293D632038E7B3590C9B885C5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...................................k..)...4.wW*eh.....B.B................`.... ....o.w....`...`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_UM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_US.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_VG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQpxlzJstP9hj:SvfJstz
                                                                                                                            MD5:84781FB37996AE5ED3C3E0E3BEB4455A
                                                                                                                            SHA1:ECD887370A4453E67A642A46BEF4BB4593C0CEDD
                                                                                                                            SHA-256:B94B6BAE10B1B207ADFB721F38C9BDABF1B3619C2C82AFE24C7A0F823F9CA38E
                                                                                                                            SHA-512:FFFC82BE344ACDAFA125A7A9BA3D79939F695B3C8A1AA66D8C0092847B7487385C979175F37D7DF39EB3334F56621DF78D3B2B087E7AE5D40972DD37ED42B109
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\es_BO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):276
                                                                                                                            Entropy (8bit):4.716134931707854
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvwSmfStaFlqE2WhkTFkTFk75IVYTeME/Bscf+q+N:nnmIVYYCcft+N
                                                                                                                            MD5:2A5A5D2CCC801C8DBE46AF8F04EA2D26
                                                                                                                            SHA1:EF6FC7AC4C1D37633FC55FA252B33B6902B2E4E9
                                                                                                                            SHA-256:DFAE3560E283006682100489719D46DA98D20D794B2DEDF947C709D051C85C2F
                                                                                                                            SHA-512:09BD05607F6456E445316A074ABE4BC30AF2A6522F6FF8D1CB05E70A75D998BFE34262CF45CDF6572E5354C864044BA241041220A6888D90A881F70046062586
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................5.. ........=...=..........................NN.......4.....4..k..)...4......c....................4.........4.........4.....4.......P....... ...........P...P$..P....#.. ..j.v...................(.. ..`.*.. ....)..P......o.w...(..`!.. ...`1.. 3..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\es_CU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.147089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQpxlzJstP9h8:SvfJstM
                                                                                                                            MD5:8502B5B5CF8FF0AC0239AD4177A21BE1
                                                                                                                            SHA1:94D80D600D5E0E241979FF136C9369E6699A4E0A
                                                                                                                            SHA-256:29BD99C48E6B952990C208543342883CAB53EB68202F225EB293747A8451EEFF
                                                                                                                            SHA-512:99EE900C8FC4BE3C17772F11D2E537A046D60E730DFCD1E246C7540988691E08A6188C6759720F66AB71108577AE791B3590BB7C7EA55F64F9F8A47578528039
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.(...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\es_EC.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):256
                                                                                                                            Entropy (8bit):4.44420201856998
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvSB+ZlIsgFldkTFkTFk0hUG/HAvxlk9jbCikap6oV:gOvMGfALGUap6oV
                                                                                                                            MD5:801F9E284F6D1E5FEB62097AE9B98E57
                                                                                                                            SHA1:AC8108D2DBD09245B770D51EAE0BCC4E22278662
                                                                                                                            SHA-256:C2697FA67D09E9A699DDB83063981A7C184384E56AC5046CFFB5B5855B9DC3F8
                                                                                                                            SHA-512:5F76375EB9FBEE0BF2E33C5BF600A624B86B236FCCBF8F7075CEA2F11AA480D948C816F6DAF2DAC63585E657A03E29D353080361245DBDA65DA7FDCA34CC7180
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................0.. ........8...8................................NN.......4.....4.........4.........4.........4.....4.............P...P....... ...........P...P...P.... .. ..j.v...........%.. ..`.'.. .......P......o.w...(..`... ...`,.. ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\es_NI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):236
                                                                                                                            Entropy (8bit):4.547719704207099
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlBFQlllWJlvtIP9SB+kTFkTFkyB84ePsZlxjmGkmvzGMmE/exz9sSN/5:Sv8l/WrOkB+kTFkTFkBixiCzGk+2+/SK
                                                                                                                            MD5:B79F5A39332B878BA4B05DEBD7B0F367
                                                                                                                            SHA1:8069441A0E3C184705054FD57B26DE0F1F59B0AA
                                                                                                                            SHA-256:6503CD2C7AAA9F95F33C378A2F0CD12AF4D5B5DA4EE5BBECD62789E9C5C4A42F
                                                                                                                            SHA-512:B56A2B9DC4D9D937A8EF67E9205E62FA51364AC04BA8A245D2DD8ED4F6E59DEC41520BE32E5DC6B61E0891E1D397C280142FD3B389538920AAC942B1423422E1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................,.. ..N.....3...3..........N..............4.....4.........4.........4.........4......H............N.N.............P...P...P....... ..j.v.............. ..`.!.. .......P....(.. ....o.w.....(..`...`&.. *..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\es_PE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):880
                                                                                                                            Entropy (8bit):5.200318139086651
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:c+dflKt57gHBiYIH5HEektCFxExtkKNovPfK6gQ0dAs:JAZgCH5kektkEI44Pf10d9
                                                                                                                            MD5:8A1F8F9C2B643A831246038949D38A86
                                                                                                                            SHA1:175C7AC6E783B3A58565B31EC3F65CB099DE1D09
                                                                                                                            SHA-256:9DA5B83F7DAA17CF642C7440F371BD2AB86170424125E991645F5DAD40C5AA9E
                                                                                                                            SHA-512:6641903C46A1FF3352F6C48783077DCD83D1FD1C56EAD865A58C3B1A8B0B36B3CB1E7820A06341BE3408C21DC21CDC016135D54AC409C6B35E35D789A8193CA0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................................D.i.c.....E.n.e.....M.a.y.........0...B.......0...K.......0...M.......0.0...B.......0.0...K.......0.0...M.......0.0.0...B.......0.0.0...K.......0.0.0...M.......0.0.0.0...M.......0.0...M.R.D.......0.0.0...M.R.D.......Y4....J.........J.#.#.....J.9.9.....J.........J.*.*.....J.A.A.....J.I.I.....J.R.R.....J.[.[.....J.........J.........J.1.1...k..)...4....k..\...............4.....4..k..)...4....eh9....................4.........4.........4....z..O..3.........i...).....Z.K...|.?.9.j..G.!.#."......1G..........eG6.......!.....a...q.k...T"..@".!....E.P.V.].e.n.x.............n..Ps..Px..P}..P...P...P...P...P...P...P...P...P....... ........k..P... ....... ...................P...P...P....... ........................................... ... ..j.v.....H................ ... ....`...... ... ......o.w...(..`... ~ .`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\es_PR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):344
                                                                                                                            Entropy (8bit):5.134834454312531
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvzxYe41GgLk28RWvkP2qRnslkzRgTFkTFkKklWF6/ZlMQOXhtVFn:Pe4Li0vkPf2CkIF6R+Zn
                                                                                                                            MD5:382D40B9353199767794FEF42ADE4B90
                                                                                                                            SHA1:FBB58513DE85802CD6AB6D673E66A69B9CC18E16
                                                                                                                            SHA-256:7A099DC250854B3559F585EEC33EF9AE3F7B535837E0306380E70A67932A2A9C
                                                                                                                            SHA-512:9CA9F327F9826C68D2FF708BC9B44781C236DBC0E25F020375132850BCCA28F44651DF0EC1C5464A4457299B7FF018F64BFB79E17B127214339BC673D109FD98
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................I.. ........N...N...........2........M.M./.d.d./.y.y......h.B7w.3....FB.b..............!.......8..8q;DBFB.....4.....4...h.B7w.3.....$................!..... .8..8.).$.$.........4.........4.........4.................P........B..PG..PL..P....6.. ..j.v.......#...&...)...7..P;.. ....`...2.. =.. ....o.w.(..`...`E..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\es_SV.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):264
                                                                                                                            Entropy (8bit):4.6054641400735505
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:Svoql/Al/G/NgB+kTFkTFkQEMHCjswlym4GIVgGN:pqtBeBkEMijsQyOAlN
                                                                                                                            MD5:599E0BAE3F8E59F315CC28AC651D000F
                                                                                                                            SHA1:90B395C9F6B64CD5270EBA837BC0438FF152176F
                                                                                                                            SHA-256:6A5A231A16944B786BDA22C49A3B0DCC1F983C87F56EB0CCE11206CBE67AE36E
                                                                                                                            SHA-512:FAC93DBDAB0EF16C98977656B0126A4154A4181095BD935DAAE5DB6A18246D0AE182C38AE07C59629B784DC93D0F04A63AD07CA2E6522995539C5F299D6DDA2F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................3.. ..N.....:...:..........N.........a.n.t.i.e.r........4.....4.........4.........4.........4......H........N...N.N.....4.............P...P...P....... ..j.v...........$.. ..`.&.. .......P........-.. (..P....o.w.....(..`...`+.. /..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fa_AF.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1252
                                                                                                                            Entropy (8bit):5.561173248216956
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:oXbwyqMsKJrL6OTqZNRoL/ufRpfDX6ULOsAtMqZQ:oXbwynqO+jobMRpfHOPt6
                                                                                                                            MD5:8C8D7A6AFED45C5BFECF17C268CED17C
                                                                                                                            SHA1:C8BAE7DE7F7866C3663B9C0CA5B5D8C3811E18EB
                                                                                                                            SHA-256:80F8D3D6C774C045A38056EC2C9323B8E69FA03DB6D720B16E02318C3B8F2D7C
                                                                                                                            SHA-512:724F6B78755E8064F6BB4F67C6A92932229B7DC0F7C1A366BF0EDB2F6374DA5BA7EC6A7C3D3241D4352F7EEB5DF643C94687423B016A4E56EEB9D79F54AFE8EF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................*.. ........1...1....................+...9...B...E.....1.....1.....1.....1.....5.(.-...B.H.3...'.3./...+.H.1...,./.....,.F.H...,.H.D...-.E.D...-.H.*.../.3.E.../.D.H...,.H.2.'...9.B.1.(...3.1.7.'.F...E...2.'.F...(.'.E./.'./...A.(.1.H.1.....3.F.(.D.G.T...F...E.G.. 4.(...1.(.9. .3.H.E...1.(.9. .'.H.D...1.(.9. ./.H.E...(.9./.'.2...'.4.*...1.(.9. ...G.'.1.E...(.9./. .'.2. ...'.4.*.....[.. . .N. .P. .O. .R. .V. .p. .. .. .%. .|. ... ... ... ... ... ... .C. ... ... .I. .J.].......Y4........Y4........................................ .'....)..G...j..4..eN....N..).M.i.O...............#2...................#2...................#2..........F..............#2..................%.......5........... ... ..........'...............%.s.....5.................%.s.....5........... ... ..........'...............%.s.....5..............".*...<..........".*...<...................................... ...............P.......P........... ... ...........P...P....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ff.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2024
                                                                                                                            Entropy (8bit):5.174909093296085
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:MU5RKptfOKtdSVtIlb8tyY4Acxfi6ZW/OmZQzVVp:7RKpdOKfSVOlb894Acs7mzPp
                                                                                                                            MD5:9BFD201E21A532D247D2DC903B956E0A
                                                                                                                            SHA1:8EAB8685683F9AA577A96D270B4B5173BBB372AC
                                                                                                                            SHA-256:46C81B7792A250AF3558E439E5DEDB8F5CFEF5B92E19FC28A671DE15B8411A9E
                                                                                                                            SHA-512:2939D5D19470347C21814E5E39F24A6594AF8C669D4B3EEE6CA927E8D7120A4154C75BA5B0AD2508912F8F5C03844465E2697DE9DDB49B901162309AAEA0A107
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................................C.-.I...H.-.I...a.a.S...b.o.w...c.o.l...d.u.u...h.b.i...j.o.l...j.u.k...k.o.r...m.a.w...m.b.o...m.o.r...m.w.d...n.a.a...s.e.e...s.i.i...s.l.t...d.e.w.o...j.u.k.o...H.a.K.k.i...H.o...o.m...L.e.w.r.u...W.a.k.t.u...b.o.w.t.e...c.o.l.t.e...j.o.l.a.l...k.o.r.s.e...m.b.o.o.y...m.o.r.s.o...s.i.i.l.o...s.u.b.a.k.a...H.a.n.n.d.e...J.a.K.n.g.o...S.a.h.n.g.a...a.a.S.n.d.e...d.u.u.j.a.l...m.a.w.n.d.e...s.e.e.W.t.o...s.i.i.l.t.o.....a.l.n.d.e...k.i.k.i.i.W.e...J.a.m.a.a.n.u...Y.o.n.t.e.r.e...H.i.t.a.a.n.d.e...M.a.j.a.a.n.g.o...T.e.r.m.e.s. .1...T.e.r.m.e.s. .2...T.e.r.m.e.s. .3...T.e.r.m.e.s. .4...m.a.w.b.a.a.r.e...y.a.r.k.o.m.a.a...H.a.d.e. .I.i.s.a...[.q. .v. .x. .z.]...n.a.a.s.a.a.n.d.e...n.j.e.s.l.a.a.r.e...h.o.o.r.e.-.b.i.i.r...C.a.g.g.a.l. .I.i.s.a...D.i.i.w.a.a.n. .w.a.k.t.u.....a.l.W.i. .y.o.n.t.e.r.e...7.[.A. .B. ... .C. .D. ... .E. .F. .G. .H. .I. .J. .K. .L. .M. .N. ... .J. .O. .P. .R. .S. .T. .U. .W. .Y. ...]...7.[.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ff_CM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.870450165586334
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/6RYMmlle3:SBtkJYlU8g8l/Pnlg
                                                                                                                            MD5:B0883BC684E2083DCFB7987BF29CB154
                                                                                                                            SHA1:93CA18C6EF789971AC3965F1B55FD4311A782661
                                                                                                                            SHA-256:E8FBBF9C040D66A6F79C5F2143599852A26E7F63E476F1D8AEB8AF38651017D1
                                                                                                                            SHA-512:6F36CC2841D7A7E75C27063806AC56E1CC0E38C1ED3862DDF0F243B4A19FDE47C53E371F80AE670DF5D2196DE96B3804FF478DD8551AC37639F29C77194EF679
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.................................f.f._.L.a.t.n._.C.M...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ff_GN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.870450165586334
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/6RYMpe3:SBtkJYlU8g8l/Pf
                                                                                                                            MD5:107782CB49500FC51B8E89C6BFE16DD1
                                                                                                                            SHA1:86062C938918B822D5FCCE2AF25914255ED05A03
                                                                                                                            SHA-256:C18C8F96F8A5A6109B9AB88A9FA1458ACB0DA75FA74ED4B5AE71C5D30F7E8C54
                                                                                                                            SHA-512:DE56C5EDC926BC62988B40D24F08516EADDE9301F28FE9F28645190C45892EDB54B4812241297E027706DE0DF0A6A551A65516C0A99AFE921230BE6E971D4374
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.................................f.f._.L.a.t.n._.G.N...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ff_Latn_CM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ff_Latn_GH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):132
                                                                                                                            Entropy (8bit):3.971696932789431
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlgSlE/cmlvlllQ9grNrceRn2T22Pc3nslulflFpDN/F:SvQSlcPZZrzn2T22Pc3nVTFjF
                                                                                                                            MD5:51874CD570FDE1EF76584D484F003123
                                                                                                                            SHA1:972492DE9F6DB03504D92666FAA793A12174356C
                                                                                                                            SHA-256:6712CA123B9C3B3C192B15BED74912047AA9F473113C7E79EADA47DB4F3DCE08
                                                                                                                            SHA-512:4257742E18BE5FB2B23D26BADB2B264ECA1752EADAB99CFFD2DE930697F797E010A6F3E935EB3C9F884CA710BAE5EEBC472A14EACCDCCF2AABD83263FA81F0A2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .8w...................8w............h.B7w.3.MW*.).4......................`.... ..o.w......`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ff_Latn_GN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ff_Latn_NE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ff_Latn_SL.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):132
                                                                                                                            Entropy (8bit):3.971696932789431
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlgSlE/cmlvlllQ9grNrceRn2T22Pc3nslulflFpDN/F:SvQSlcPZZrzn2T22Pc3nVTFjF
                                                                                                                            MD5:51874CD570FDE1EF76584D484F003123
                                                                                                                            SHA1:972492DE9F6DB03504D92666FAA793A12174356C
                                                                                                                            SHA-256:6712CA123B9C3B3C192B15BED74912047AA9F473113C7E79EADA47DB4F3DCE08
                                                                                                                            SHA-512:4257742E18BE5FB2B23D26BADB2B264ECA1752EADAB99CFFD2DE930697F797E010A6F3E935EB3C9F884CA710BAE5EEBC472A14EACCDCCF2AABD83263FA81F0A2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .8w...................8w............h.B7w.3.MW*.).4......................`.... ..o.w......`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ff_Latn_SN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25004
                                                                                                                            Entropy (8bit):5.121435767724072
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:2L59kH58Vk/calos5zdDPupFHM2IinQRhjjsdRCxwn40:2XkH58Vk/canRDPupFHM2IinQR/xw40
                                                                                                                            MD5:7857B0B72BDAA17EA21B9A508F57FCE2
                                                                                                                            SHA1:64CD6E4E75976D4425566FB363BCCCA5E08F997A
                                                                                                                            SHA-256:6C46B9C5FD632F2E66C4C37C221F9B55D112205DB61E9AA9A1AF351E0D451E60
                                                                                                                            SHA-512:EB4169E9B144328F8B7637A4BB3AE14B938E742555E60CCD1CD65F2BFA812946AD852C0E3E47659DABEF893C7262DB31B25F7CFD1C87F18A601ECE9A54147F53
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................I.. ........c...c...V.......F........n.y.t...k.p.....k.y.....L...y...e.a.a...j.K.r...j.a.a...s.......a.a.m.u...i.l.t.a...a.d...r...e.l...l...s.y.y.s...e.K.r.....e.a.a.....e.p.i.p...j.K.r.....j.a.a.....k.e.h.o...k.e.s.....l.o.k.a...m.u.u.t...e.i.l.e.n...L...y. .G...i.j.j...r...n.i.s...n...s.i.v...n...t.e.v...t...t.i.a.r.....a.e.v...t...a.b.k.u.u...e.l.o.k.....e.l...i.n...h.e.i.n.....h.e.l.m.i...h.u.h.t.i...h.y.m.i.....j.o.u.l.u...k.a.s.v.i...k.o.i.a.k...l.i.p.p.u...l.i.p.u.t...p.a.o.n.i...p.a.o.p.i...s.y.d...n...t.a.m.m.i...t.h.o.u.t...t.o.u.k.o...t.u.n.t.i...i.l.t.a.p.....t...n.....n...r.a.d.~.a.b...k.i.s.l...v...a.a.m.u.p.....a.d...r. .I...e.n.s.i. .v...h.e.a.v...n...t.a.m.m...z...t...n... .v...a.a.w.w.a.l...a.a.. b.a.n...d.e.y.k.u.u...e.l.o.k.u.u...e.m.o.j.i.t...h.a.t.h.o.r...k.e.s...k.....l.o.k.a.k.....m.a.a.l.i.s...m.a.r.r.a.s...m.e.s.h.i.r...m.e.s.o.r.i...p.a.i.k.k.a...s.y.y.s.k.....t.i.r.k.u.u...k.e.s.k.i.p.....t...n... .s.u...k.e.s.k.i.y.....a.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fi_FI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fil.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18896
                                                                                                                            Entropy (8bit):5.60602512990592
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:K2U2ISJWd18WShrOeROng/IIx37+b3zYjiJCyvCZPb+YaoB:rE/8WSVOeROgocZPbP
                                                                                                                            MD5:08B81236FB9EBF09F08195055B8A99CD
                                                                                                                            SHA1:02E75AC8491DD7D328B69681B3D8A6A926A1E7E0
                                                                                                                            SHA-256:5FA099432E1C81E12AB5ABBB8012C0D1AA860DD361FF832F63EB5D4A3D3C0971
                                                                                                                            SHA-512:457AD442D5C65B1F513E4E0F4F6BBCA2D76A059FC3D3065F7BCCFFDA429066F9BF6588A5A9394D059793C980110B8EE292F41016384D091FC0E66FDAE4D1313F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................S.. ........l...l...V.......+........H.u...L.i...B.i.y...H.u.l...H.u.n...H.u.w...L.i.n...M.i.y...N.o.b...E.n.e...P.e.b...b.u.k.a.s...H.u.l.y.o...H.u.n.y.o...M.a.r.s.o...b.a.b.a.e...b.a.g.a.y...h.a.y.o.p...I.b.a. .p.a...b.a.n.t.a.s...g.u.s.a.l.i...l.a.l.a.k.i...n.g.a.y.o.n...p.a.n.a.h.o.n...O.k.t.u.b.r.e...P.e.b.r.e.r.o...M.e.t.r.i.k.o...h.a.l.a.m.a.n...n.g. .g.a.b.i...p.a.g.i.t.a.n...s.a. .g.a.b.i...t.a.n.g.h.a.l.i...0.0.0. .l.i.b.o...n.g. .h.a.p.o.n...s.a. .h.a.p.o.n...a.k.t.i.b.i.d.a.d...n.a.k.a.p.a.r.e.s...n.i.l.a.l.a.m.a.n...s.a. .L.i.n.g.g.o...s.a.r.i.-.s.a.r.i...h.a.t.i.n.g.g.a.b.i...n.a.n.g. .u.m.a.g.a...S.a.m.a.k.a.l.a.w.a...0.0.0. .b.i.l.y.o.n...M.M.M. .d.. d.,. .y...m.g.a. .n.u.m.e.r.o...{.0.}.,. .o. .{.1.}...s.a. .{.0.}. .t.a.o.n...s.a. .{.0.}. .o.r.a.s...0.0.0. .n.a. .l.i.b.o...s.a. .{.0.}. .a.r.a.w...s.a. .{.0.}. .m.i.n.....s.a. .{.0.}. .s.e.g.....m.g.a. .b.a.n.d.i.l.a...p.a.g.l.a.l.a.k.b.a.y...M.M.M. .d.. d.,. .y. .G...s.a. .{.0.}. .L.u.n.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fil_PH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fo_DK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_CD.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):216
                                                                                                                            Entropy (8bit):4.352892321557353
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvEGml7omAYl0JP1cMwd0hllE2VnURolFn:3tAYAc5MpNUK
                                                                                                                            MD5:51F12B12A8057A392C771E30D946BD8D
                                                                                                                            SHA1:E433B892646A05AC206091AEEEACD5BD644CB497
                                                                                                                            SHA-256:5263F3B56D9BED1B9BF3DFFFA2DB75CFF405B11DDFC54F09903D92E0571FCA06
                                                                                                                            SHA-512:98DA3BE44D21FD4C413E3679107F32D4FCDCD478D58F3DBF7E9758F597F2A4C89FD47D0EDF9FC6A4AADF7A572D055C280CEEA299A7CF40799935F3470D4578E3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................).. ..l....................l..............D............/..*...^}....l.....^....|..........P....... .......P.......P........... ... .......P....5...... !.. ..`.#.. ....o.w.... ...`'..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_CF.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_CG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_GA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_GF.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_GQ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_KM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_MA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):268
                                                                                                                            Entropy (8bit):4.613497542156425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvXtKHl7saMW2W0lOPwv+SlmtWCayl6QZSnBV:UKF7sOPXwbm2lz
                                                                                                                            MD5:6E51A3800939D2B92E283D5C0217F615
                                                                                                                            SHA1:CA1B60D5BE31ABAAC82AD0B22494160B7D0D3664
                                                                                                                            SHA-256:905B32B24BA15D2E443F112A683445E5A77227D5494DD342586A33FE6660DE44
                                                                                                                            SHA-512:382FB2573E834DBDE01DE8D4A59A0905EA3585C637BFA4DF067BA91C654E12F4EB4CC61C8C45C5CE47B2C088EE020DA01EB6A9030C73E2FFCA185C93603F1F3D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................4.. ........;...;..........."........f...v.....j.u.i.....j.u.i.l................*.......OB.u....T.{Ci...h........OB.u....T.{Ci...h..........P....".. ............$...........&.. (.. ..j.H.......*.. ..`.... ..[...o.w......`$.. ...`2..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_MG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_ML.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):324
                                                                                                                            Entropy (8bit):4.234801961619495
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:Svg/seUE82fsUUNzlsUUNRYsUbKl4wgHoGYMDyx1hT3QnUbUF:9+EaUUYUUzrUbegHWbTiUYF
                                                                                                                            MD5:550EE182EA9AE38CBC976C3B747CEC73
                                                                                                                            SHA1:A773A6CD2AB67DF7644632DBE0BAAF9A805E173E
                                                                                                                            SHA-256:69DBC1EAB9852FDE5FA6F3E0074FE2C053C6B372DFDA37F805EA47A276A680A1
                                                                                                                            SHA-512:6FBB8CE5B15522E3A132C54C924CEA53C08723B3046D61BFAB48C518179C784B3D59CE6FDB56D5C57E2498498CB8CFC5C4639698ACF98963FD9DEE9348B633D5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................D.. ........I...I...........2........l.e. .2...m.e. .t.r.i.m.e.s.t.r.e...l.e. .3...m.e. .t.r.i.m.e.s.t.r.e...l.e. .4...m.e. .t.r.i.m.e.s.t.r.e........D..k..)...4.MW*eh.....5.5......_{........b{..........7..P....2.. ....H.......M...........6.. 8.. ....S...:...:.. ..`.>.. ....o.w.4.. ...`B..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_MU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMQut6E7lIt6EKC:SvQt6gOKC
                                                                                                                            MD5:2E5503409EC26800FCF6A9B1D64DBE57
                                                                                                                            SHA1:5962F8204C362DFEF2B60CDA43363D4811D686C6
                                                                                                                            SHA-256:D5D3C00CA62F706F59183248BBE5FE5C6FB721E544D3A665A8BD03B4B5F73478
                                                                                                                            SHA-512:649675774963C12D5776F5D8D12580F79ACD476C21056662D5391AC262E82A56ADC751807EA94F8D59979733BBED2616A8BF1BCA16AF5D89350AA473E21108BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_TN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):132
                                                                                                                            Entropy (8bit):3.9290313309779283
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlkAll8/mlvlllgggrNrxVvK28nslulflFp9ok:SvUA/8OP4XZrxVvK28nVTFck
                                                                                                                            MD5:4CF3AA31B641864AB60EF738B2B9903A
                                                                                                                            SHA1:92DB1CF0B23B8D187B404B1693C3841F16152BDA
                                                                                                                            SHA-256:4D2BBE1D4D9D0A4266448241596BCA9DA40A34D96E4FD309A205350156DE0134
                                                                                                                            SHA-512:E7E01AB79CE30F51B69B1C7094C325D55E08DA3703C05ED0741B05D30B2C4D662587338141AA5BF6EE9015CE1DFF2094982A40BA58F4ABCA7CF3E8C1A954E2EC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ....................................h.B7w.3.MW*eh...5.5.5.5..............`.... ..o.w......`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fy.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9864
                                                                                                                            Entropy (8bit):6.028223099015054
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:W9hNlTjzDDD0DwxDWDHDpDVOEY8zUwHH2HdEhtFQDHkMEYP0w8lWsxVe:W9hjDDD0DmDWDHDpDEErLHH2Hd+Qbkqf
                                                                                                                            MD5:682FA0B11EFDB3D6B3109142943B5D0F
                                                                                                                            SHA1:E0E97C7BEC5FE6F7C5E373B0FB811E38BE8D0A94
                                                                                                                            SHA-256:AFE813885F2A9C431A276F976D9CFD979771345F28CE158EBFC29D3CCEAB56A6
                                                                                                                            SHA-512:4F429D583697E84B4745D4DB15DB684625E0894A641641E103F263416D6F8A23496E330A1473024EF799830109D23B7F86D55F22288378290B675D835D767A6D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................)................T.u.t...A.a.p...H...n...M.r.t...R...t...f.g.j...A.b.i.b...T.. e.r...G.e.i.t...J.u.l.y...J.u.n.y...K.n.y.n...O.k.s.e...S.j.a.....J.i.e.r...W.i.k.e...f...K.....n...K.....B.a.b.a.h...T.u.b.a.h...D.r.a.a.k...M.a.a.i.e...M.a.a.r.t...M.o.e.h.....S.j.a.w.....S.l.a.n.g...B.r.i.t.s...M.i.n...t...n...K.r.....A.d.a.r. .A...A.d.a.r. .B...E.l.l.o.e.l...K.i.y.a.h.k...M.a.a.g.h.a...S.j.e.v.a.t...B.a.a.r.c.h...H.o.a.n.n.e...H.y.n.d.e.r...S.j.a.w.a.l...f...g...j.....M.o.a.n.n.e...B.a.. u.n.a.h...P.a.g.u.m...n...T.a.m.m.o.e.z...T.i.s.j.r.i.e...J.o.e.m... .I...M.e.t.r.i.e.k...S.e.k.o.n.d.e...[... ... ...]...v.a.n.d.a.a.g...C.h.e.s.j.w.a.n...J.y.e.s.h.t.h.a...K.a.a.r.t.i.k.a...A.u.g.u.s.t.u.s...D.e.s.i.m.b.e.r...J.o.e.m... .I.I...N.o.v.i.m.b.e.r...T.i.i.d.s.r.i.n...d.i.t. .j.i.e.r...0.0.0. .t...z.e.n...S.e.p.t.i.m.b.e.r...O.e.r.m.o.r.g.e.n...F.e.b.r.e.w.a.r.i.s...J.a.n.n.e.w.a.r.i.s...d.i.z.z.e. .w.i.k.e...d.i.z.z.e. .f.r.e.e.d...d.i.z.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\genderList.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):536
                                                                                                                            Entropy (8bit):3.9455462591583674
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:WZtxKuBFaCXNbCv/SmtRguJR1nnX3Hv8UQnfRC83fEUM:WZbKOjpAXtRRRVX3v8UQnfw83fEUM
                                                                                                                            MD5:4909058929BDECA58C1E06AB23AFDCFD
                                                                                                                            SHA1:ACEEA31958CE39C3CDE0D03104B1E4524A1E4FBF
                                                                                                                            SHA-256:50BB23ABBE3B69E98B6949ED3DC57811832BC1D5BA15254414A97231BD788AF4
                                                                                                                            SHA-512:ABF3F12D893D30282B40100BE7C85003CEED2AF8F75BAD3CD123430EFF98E7ED467EF827945E3C3ACE28D39A9268F6922DF3CF9EF0EA36880CDFD6A1321F7649
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................|.. ....5...~...~...6.......|...genderList.af.ar.bg.bn.ca.cs.da.de.el.en.es.et.eu.fa.fi.fil.fr.gu.he.hi.hr.hu.id.is.it.ja.kn.ko.lt.lv.ml.mr.ms.nl.no.pl.pt.ro.ru.sk.sl.sr.sv.sw.ta.te.th.tr.uk.ur.vi.zh.zh_Hant.zu....n.e.u.t.r.a.l...m.a.l.e.T.a.i.n.t.s...m.i.x.e.d.N.e.u.t.r.a.l...6.+...1.4.7.:.=.@.C.F.I.L.O.R.U.X.\._.b.e.h.k.n.q.t.w.z.}................................................................................................................................................................... .!..P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\gl_ES.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\gsw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3572
                                                                                                                            Entropy (8bit):5.800435594663508
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:eq3YGnCz1oLJ9iniJfziRUxwiH4Ge51dsn:uz1oLDinipiRMHOdsn
                                                                                                                            MD5:8038A8A283CF68FB9924ADCDBFD11331
                                                                                                                            SHA1:7E659DFE3E801BB7E99377494510F2CCD10921AF
                                                                                                                            SHA-256:D26995ABBE7F08FDF9333CBE86BF8025381A9D64DD7640E6CAEAFCCD429212CF
                                                                                                                            SHA-512:F7CD8724778A0EE69E144D6A0F73383CDBB72DFB86410F91AAF6BF9F8AE55823454B9025338B827263644A5A3DF9CCD8A612F5A41166F6A03C927139405C4A77
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................e.. ........u...u...........u........D.u.....F.r.....M.i.....M.......S.u.....Z.i.....h...t...J.a.a.r...n.a.m.....A.a.b.i.g...M.o.n.e.t...N.a.c.h.t...W.u.c.h.e...z.a.a.b.i.g...z.n.a.c.h.t...M.i.t.t.a.g...z.m.i.t.t.a.g...F.r.i.i.t.i.g...M.i.n.u.u.t.e...M.....n.t.i.g...S.u.n.n.t.i.g...a.m. .M.o.r.g.e...A.u.g.u.s.c.h.t...D.e.z...m.b.e.r...M.i.t.t.w.u.c.h...N.o.v...m.b.e.r...O.k.t.o.o.b.e.r...W.u.c.h.e.t.a.g...m.e.t.r.i.s.c.h.....b.e.r.m.o.o.r.n...D.u.n.s.c.h.t.i.g...S.a.m.s.c.h.t.i.g...Z.i.i.s.c.h.t.i.g...0.0.0. .T.u.u.s.i.g...0.0.0...T.s.g.'...'...a.m. .N.a.m.i.t.t.a.g...v.o.r.g.e.s.c.h.t.e.r...T.a.g.e.s.h...l.f.t.i...0.0.0...T.s.g.'...'.......0.0.0. .B.i.l.l.i.o.o.n...0.0.0. .M.i.l.l.i.o.o.n...0.0.0. .B.i.l.l.i.o.o.n.e...0.0.0. .M.i.l.l.i.o.o.n.e...a.n.g.l.o.a.m.e.r.i.k.a.a.n.i.s.c.h...E.[... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... .-. ... ... .+. ... ... ... .O. ... ... .M. .S. ... ... .m. ... .k. ...].......7.....y.B.)......J.......

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\gsw_LI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\gv.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1344
                                                                                                                            Entropy (8bit):4.205968556156306
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:GksWkTiI1jIZl3+jyX/+hlVDQ+dss9NyDACuHuCuMSu0VS39irT4uBF77jd9H:PsWRI1jIZU7CU0aoPl
                                                                                                                            MD5:DC7D4EC2D1831B8A82F08869B380A8F9
                                                                                                                            SHA1:C4D4C2476657E5F079292D2D87CB43AF9F83D148
                                                                                                                            SHA-256:750FD42148E8990A976B2C9F62807835CA38D42A452E95333D334D79639C8514
                                                                                                                            SHA-512:480C3F5DCE7D35AF77DD0BD4040B06AA81EA901C0A58C7183B38BD13232B6A0560FC5D3CB5DCCB417118BB5F2CDBE3B6FD005B4003183882FAF3C9B1666C57CD
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................>.. ........H...H....................R.C...J.e.d...J.e.h...J.e.l...J.e.m...J.e.s...J.e.r.c...J.e.r.d...M.a.y.r.n.t...A.v.e.r.i.l...A.v.r.r.i.l...J.-.g.u.e.r...J.e.s.a.r.n...B.o.a.l.d.y.n...J.e.l.h.e.i.n...J.e.m.a.y.r.t...J.e.r.c.e.a.n...J.e.r.d.e.i.n...T.-.a.r.r.e.e...J.-.f.o.u.y.i.r...J.-.s.o.u.r.e.e...J.e.d.o.o.n.e.e...J.e.h.e.i.n.e.y...M.-.H.o.u.n.e.y...M.-.f.o.u.y.i.r...M.-.s.o.u.r.e.e...L.u.a.n.i.s.t.y.n...M.-.N.o.l.l.i.c.k...M.e.e. .H.o.u.n.e.y...M.e.a.n.-.f.o.u.y.i.r...M.e.a.n.-.s.o.u.r.e.e...J.e.r.r.e.y.-.f.o.u.y.i.r...J.e.r.r.e.y.-.g.e.u.r.e.e...J.e.r.r.e.y.-.s.o.u.r.e.e...M.e.e. .n.y. .N.o.l.l.i.c.k...T.o.s.h.i.a.g.h.t.-.a.r.r.e.e...{.0.}...h.u.n.n.a.g./.v.u.c./.o.o.y.l...{.0.}...t.h.u.n.n.a.g./.m.u.c./.o.o.y.l...{.0.}...t.h.u.n.n.a.g./.v.u.c./.o.o.y.l...{.0.}...t.h.u.n.n.a.g.y.n./.m.u.c.y.n./.o.o.y.l.y.n...{.0.}...d.y...h.u.n.n.a.g.y.n./.d.y...v.u.c.y.n./.d.y...o.o.y.l.y.n...7.[.a. .b. .c. ... .d. .e. .f. .g. .h. .i. .j. .k. .l. .m. .n. .o. .

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ha.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4568
                                                                                                                            Entropy (8bit):5.913040697749047
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:nszCz9tVyDdvPu/eCMxQz4s0zHdQ9r03HdQ9rfGVRAkPjq8+7:n2CjV8dv2/yGuz999SGgku8+7
                                                                                                                            MD5:FE43EFA3B9B8927080FF1352FC3A02D4
                                                                                                                            SHA1:B376FC744C14D48BFEB6861DEC28FED967032693
                                                                                                                            SHA-256:D0281A21D01EF8CC421575F5402EAB5291D0B7EF7C664AD13FA173B40E6EB574
                                                                                                                            SHA-512:87AF3E22CC6A7F6AB65B8A4B9707A68C1B5BBF0F8E1685EEDC91FA3B1B34AC18675D8E4B104568D42D2F52BDCC9D9373B8B17F4930D831CCD8D0977314E300A0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................[.. ........n...n...1................A.l...A.s...L.h...L.i...L.r...T.a...A.w.a...Y.a.u...A.f.i...A.s.a...F.a.b...L.a.h...L.a.r...L.i.t...N.u.w...K...H.......0.D...G.o.b.e...J.i.y.a...M.a.k.o...W.a.t.a...M.a.y.u...Y.u.l.i...Y.u.n.i...B.H.A.I.......0.0.D...K.w.a.n.a...K.w.a.t.a...M.i.n.t.i...K...H...Y...M.a.r.i.s...B...H...Y...Y.a.m.m.a...D.a...i...a.......0.0.0.D...A.g.u.s.t.a...A.s.a.b.a.r...D.u.b.u. .0...L.a.h.a.d.i...S.a.f.i.y.a...S.h.e.k.a.r.a...A.f.i.r.i.l.u...A.l.h.a.m.i.s...D.i.s.a.m.b.a...D.u.b.u. .0.0...J.a.n.a.i.r.u...J.u.m.m.a...a...L.i.t.i.n.i.n...N.u.w.a.m.b.a...S.a.t.u.m.b.a...D.u.b.u. .0.0.0...,.[... ... ... ... ... ... ... ... ... ... ... ... .p. .q. .{.r...}. ... ... ... .v. .x.]...5.[.A. .B. ... .C. .D. ... .E. .F. .G. .H. .I. .J. .K. ... .L. .M. .N. .O. .R. .S. .T. .U. .W. .Y. ... .Z.]...C.[.a. .b. .S. .c. .d. .W. .e. .f. .g. .h. .i. .j. .k. ... .l. .m. .n. .o. .r. .s. .{.s.h.}. .t. .{.t.s.}. .u. .w. .y. .{...}. .z. ...].......7.....Y4

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ha_NG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\hu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18092
                                                                                                                            Entropy (8bit):5.595054760307402
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:GD/kAwlk0XuWv6Sa+RsvpCjpMPIPXcppIAt8mqxltFLJJ89WDanJJv:GwAwlk0XuWv6cRsvpDPP/tLCC9CanJt
                                                                                                                            MD5:37A0FC03E5453CF3D0E76ED34587A4C9
                                                                                                                            SHA1:E921B5FCCA20B4DCA4CC9EE87F67B89763807384
                                                                                                                            SHA-256:E3C03307CBD94E484BF970BB41F98B10EFB1E5F39E369EA0B9287E440CB5AC8C
                                                                                                                            SHA-512:3D555398275861B8D29880AF3BA7B1AC5D0D1BE2F039DC8CF45DC4B9992F7728C56DCD001922306ECDA4EFFA1CB6604849DCBF33088D66AB28F37E20CE93EF53
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................V...................C.s...S.z.....v...M.F...T.....n.Q...d.e.....d.u.....d...l...S.z.e...S.z.o.....r.a.....r.a...I.V.....e.s.t.e...G. .y.....I.j...r...S.v...t...T.h.o.t...T...b.i.....d...r...I.I.I.....M.. M.....j...l.....j...n.....m...j.......p.r.....M.o.h.....R.e.d.....S.a.b.....S.e.v.....h.e.l.y...i...e.....i.s.z.....m.o.s.t...s.z...v...t.e.s.t.....j.f...l.....j.j.e.l...0.0.0...E...A.t.h...r...M.e.h.i.r...P.a.u.n.i...T.i.s.r.i...S.a.b...n...e.g.y...b...m...j.u.s...m...r.c.....a.n.g.o.l...f...r.f.i...i... .e.....i...s.z.....y... .M.......l.l.a.t...h.a.j.n.a.l...r.e.g.g.e.l...H.e.s.v...n...N.i.s.z...n...P.a.o.p.h.i...S.z.i.v...n...T...v...s.z.....d...r. .I...h.o.l.n.a.p...t.e.g.n.a.p...R.e.d.s.e.b...S.e.v.v...l...i... .s.z.....j.a.n.u...r...j...l.i.u.s...j...n.i.u.s...s.z.e.p.t.....G. .y.. y.....R...b... .1...R...b... .2...R...b.i. .I...n...v...n.y...s.z...m.o.k...u.t.a.z...s...z...s.z.l.......p...l.e.t...0.0.0...E.......K.i.s.z.l...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\hu_HU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\hy_AM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ia.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):13244
                                                                                                                            Entropy (8bit):5.346525451471591
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:Buc+QEbNN5Yc+gTsS7zEldvw4mQfIA554:Buc+QEJbBzQfy
                                                                                                                            MD5:BA067583F68568C52B1C2CEA578BA60F
                                                                                                                            SHA1:781D0CDA74B59F2D2F3BD4C44CA8577979829521
                                                                                                                            SHA-256:A15E19FCF00BE14BD2BEEABC2C36B69E3F1EA36FB33E92D303D1B5B772660612
                                                                                                                            SHA-512:0C8D22DF97F3486B542EE408F6D98F5EC219F1A385FECF1C074578AA3F9910CF03312689E406C50E5D160BE8A13549314F4F56A83805F065E0985A556906432A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .z..............V.....z..........j.o...j.o.v...o.c.t...v.e.n...a.E.C...h.e.r.i...l.o.c.o...h.o.d.i.e...c.l.a.v.e...c.i.f.r.a...c.o.r.d.e...d.e.m.a.n...m.e.t.e.o...v.i.a.g.e...m.a.r.t.i.o...p...C.h.r.....a...C.h.r.....a.l.t.e.r.e...d...d...a.....d...d...s.........0...b.l.n.......0...m.i.l.......0...m.l.d.......0...m.l.n...0.0.0. .b.l.n...0.0.0. .m.l.d...0.0.0. .m.l.n...a.u.g.u.s.t.o...o.c.t.o.b.r.e...c.o.r.p.o.r.e...f.e.m.i.n.i.n...n.u.m.e.r.o.s...o.b.j.e.c.t.o...s.a.g.i.t.t.a...s.e.c.u.n.d.a.......0.0...b.l.n.......0.0...m.i.l.......0.0...m.l.d.......0.0...m.l.n...d.e.c.e.m.b.r.e...j.a.n.u.a.r.i.o...b.a.n.d.i.e.r.a...f.e.b.r.u.a.r.i.o...i.s.t.e. .d.o.m.....i.s.t.e. .j.o.v.....i.s.t.e. .l.u.n.....i.s.t.e. .m.a.r.....i.s.t.e. .m.e.r.....i.s.t.e. .s.a.b.....i.s.t.e. .v.e.n.....b.a.n.d.i.e.r.a.s...b.r.i.t.a.n.n.i.c...e.m.o.t.i.c.o.n.e...i.s.t.e. .a.n.n.o...i.s.t.e. .h.o.r.a...o.r.n.a.m.e.n.t.o...0.0.0. .m.i.l.l.e.s...i.n. .{.0.}. .a.n.....d...d...s...d.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\icustd.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.8906977556519604
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlq/6ZjlllhlL4CllVcNX:SBtkJa/6lBL4C/VcNX
                                                                                                                            MD5:BA9809A2B8AEDE0B6F1E31DDE40EDF94
                                                                                                                            SHA1:0F936501FBC01CF480104043F59F5629C3B226A0
                                                                                                                            SHA-256:B60D3260DD3F92A574E49A1CFFD7812B4FE358AB74E79841D0C1CCCE872A45B8
                                                                                                                            SHA-512:F791169D12B86BDE1065C43AFB17A28F6D96E57D471BF37CE89869D256DCC74D7DCEB25E8141A4E29E705ABFDBA1B855586224435B6F15BE99CD81607275E8C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................StandardICU....... .....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\id.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15272
                                                                                                                            Entropy (8bit):5.81385632933126
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mXvRKgZj3sPludNBdyW2d8IvbCIUHRBOIA:05rdjdL2yhIUHTzA
                                                                                                                            MD5:DD1DB37C045650FCE3615342D31FC0BB
                                                                                                                            SHA1:13444EA55FDCCD22BCCCF56180317FEB34E1C9C6
                                                                                                                            SHA-256:049BC6785252417645AF0D6795607FD03F26A98A83EDDEC316D67DE6F1F5CF5E
                                                                                                                            SHA-512:BCC23B26714CFD7CC2EE5614E237DD0CE58704888C1A49EBD613A3334FE9130396FD3723A3F720D466A181C3D25D01905F502326FB4B831AE4389D86328925BF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .m..............V.....m..........S.M...A.S...K.a.m...M.i.n...R.a.b...S.e.l...S.E.U...J.a.m...[...]...p.a.g.i...s.o.r.e...m.g.g.....l.u.s.a...b.l.n.....t.h.n.......0...M...d.t.k.....m.n.t.....p.r.i.a...s.i.a.n.g...M.a.r.e.t...S.y.a.w.......0.0...M.....0.0...T.....0...j.t.....0...r.b...a.n.g.k.a...b.a.d.a.n...b.e.s.o.k...h.e.w.a.n...o.b.j.e.k...p.a.n.a.h...S.y.a.w.a.l.....0.0...j.t.....0.0...r.b...t.e.m.p.a.t...v.a.r.i.a.n...w.i.s.a.t.a...A.g.u.s.t.u.s...S.y.a.. b.a.n.....0.0.0...j.t.....0.0.0...r.b...j.a.m. .i.n.i...k.e.m.a.r.i.n...l.a.i.n.n.y.a...0.0.0. .j.u.t.a...0.0.0. .r.i.b.u...J.u.m... .i.n.i...K.a.m... .i.n.i...M.i.n... .i.n.i...R.a.b... .i.n.i...R.a.m.a.d.h.a.n...S.a.b... .i.n.i...S.e.l... .i.n.i...S.e.n... .i.n.i...h.r. .k.e.r.j.a...z.o.n.a. .w.k.t...{.0.}...h.a.r.i...R.a.b.u. .i.n.i...b.a.n.g.u.n.a.n...h.a.r.i. .i.n.i...o.l.a.h.r.a.g.a...p.e.n.g.u.b.a.h...s.e.k.a.r.a.n.g...t.u.m.b.u.h.a.n...a.i.r. .h.u.j.a.n...A.k.t.i.v.i.t.a.s...J.u.m.a.t.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\id_ID.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ig.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3712
                                                                                                                            Entropy (8bit):5.835884773736162
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:2/Tb4xPO2EGQZequxts3HcMjCFIGHRQq1:2bMxPOxtZruxtNMj8BQq1
                                                                                                                            MD5:6337A543901F7AA90833070F4DF3C92A
                                                                                                                            SHA1:8F71D0817885F729C58B2E442979535410055C33
                                                                                                                            SHA-256:EAF485FF424499951272C8FA2289B23C251D11B51A11C77AE2869FFCE8AA7EBE
                                                                                                                            SHA-512:1BB561E6B268351DEDE091B65A594FB09DDDA90449776143E7F2D9500588598B623175EFAA20FB20D7C8C2CCF03B412CFA26E37F2D055D5236A476A8FBA0509D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .6..............-.....6...............1.....2.....3.....4...j.. ..M...n...T.i.u...T.......W.e.n...I.z.u...E.p.r...J.e.n...J.u.u.....g.......k.t...T.O.A...T.a.a...P...M.....F.r.a.....E.c.h.i.....n.w.a...A...K.....J.u.u.n...T...K.....A.g.b.a...N.k.e.j.i...J.u.l.a.....M...n.d.e...T.a.a.t.a...S.e.k...n.d.....b...c.h.....E.p.r.e.e.l...M.a.a.c.h.......g.....s.t...S.a.t...d.e.e...E.l.e.k.e.r.e...F.r.a...d.e.e...N.n.y.a.a.f.....T.i.u.z.d.e.e...T.....z.d.e.e.....k.a.r.a. .1.....k.a.r.a. .2.....k.a.r.a. .3.....k.a.r.a. .4...M.e.t.r.i.i.k...N.. a.b.a.l.i...N.. ..t...t.......n.y.a.a.h.....J.e.n...w.a.r.....W.e.n.e.z.d.e.e...N.k.e.j.i. .A.f.....F.e.b.r...w.a.r.......b...c.h... ...k.a...A.f... .K.r.i.s.t.i.....b...c.h... .i.z.u...T.u.p.u. .K.r.i.s.t.i...{.0.}.,. .n.a. .{.1.}...{.1.}. .'.n.a.'. .{.0.}...M.p.a.g.h.a.r.a. .o.g.e...N.. ..t...t.../.N.. a.b.a.l.....).[.\.-. .,. .;. .\.:. .!. .?. ... .. .. .. .. .(. .). .\.[. .\.]. .\.{. .\.}.]...<.[....... .c. ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ig_NG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\is_IS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\it_CH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):228
                                                                                                                            Entropy (8bit):4.580372362566896
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:Svuldmpqr4Kl+5+/gcCqD27OyxPY8ACPqhUG/oX0F1ZSnm4l/8N:Ddmo0mkkkPTG6pmo/8N
                                                                                                                            MD5:E6407BFCE874AFF5110FFC45C2DF32CB
                                                                                                                            SHA1:C4A0CFC1F717E65A24CC7AFB13AED52EB5B95510
                                                                                                                            SHA-256:98C0037AC005C0ED74A66F5FF193AF36CCBA581EA9BB25BAE46AC6007A0FF7A6
                                                                                                                            SHA-512:D6E5D16FD4F685CFCE854E79F7D30A1EE8B99F5067EDFFB64141D90AAB40211EBB3C255261B769E0C26D02C8DF56078FCD2BDB8DFA84A1E7D55E69BF93EAE780
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................*.. ........1...1........................y.............k..)...4.wEy...]..jeje......k..)...4.wW*ehe........................P...P....... ....................`...".. $.. ..[...o.w......` .. ...`&..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\it_IT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\jgo_CM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ka.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15696
                                                                                                                            Entropy (8bit):5.6376706549133
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:v/i67HTEJAyjDfQ+cRKTUaWI0KIS9eUs+AbvG6+OSkau6FQ2f:HiqgQ+2OUTDZS9eUSbnXu
                                                                                                                            MD5:193942E35467A793AB28C29056B83A25
                                                                                                                            SHA1:8761870C6AD65117470ED40B2886BABF89772FC8
                                                                                                                            SHA-256:4EE76B3E650BEA3169EF3E5DDC5923720D337331D581CA27BF405BA43B4533F8
                                                                                                                            SHA-512:39EE362F37253EA4602E8A7F63B39EB21CDFAD94A16BF8ECC30B14517576E2A707CE36824396D9B25D19D9250256E5FBEC60F1CEC3A0952B10D00D6188B4DFF6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................5.. ........L...L...V..............................................................................................................................................................................................................................................................................................................g.e.o.r...........................................................................................................................................................{.0.}.-...................................................................I.V. ..................................................................................... .......{.0.}.-......................... ............. ............. ............. ............. ............. .......................................................-.{.0.}................................................... .......I.I.I. ............................................. .................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\kab.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2220
                                                                                                                            Entropy (8bit):5.133887433059866
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:lWYogzBV1v8su8uhIy8LKDTV4vLIb4i6vTfcFwVra:lT5zf1v8j8uhIy8LKH2zIbYvjcOY
                                                                                                                            MD5:9F1DFB3396A040402379FD6F7FD26D89
                                                                                                                            SHA1:D3BB893D512B63E1F9B2A0A810A367934B4C1644
                                                                                                                            SHA-256:B43471A74A5F43B49E1E18808648A972E6C8D1CC780ED60E7174BB92FF648715
                                                                                                                            SHA-512:6958E03C4D58C6D7B580B3CB04E91CFA305CE1DD53034AB8E7DA8818856AA6BAFA616E948AD1C4E0E5EB5CC7EBA5AEF5124F9757E5F3AF10BA14167A77D85919
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........#...#........................A.s.s...C.t.e...D.u.....F.u.r...K.u.....M.e.c...N.u.n...S.a.n...S.a.y...T.u.b...Y.a.n...Y.e.b...Y.e.n.....u.c...K.r.a.....K...g.1...K...g.2...K...g.3...K...g.4...S...i.s.....u.c.t...A.g.g.u.r...A.s.s.-.a...D.d.u.r.t...F.u.[.a.r...M.a.y.y.u...T.u.b.e.[...Y.u.l.y.u...Y.u.n.y.u...[.o. .v.]...A.z.e.k.k.a...I...e.l.l.i...K.u...a.s.s...M.e.c.r.e.s...S.a.m.a.s.s...S.a.n.a.s.s...S.a.y.a.s.s...T.a.l.l.i.t...T.a.m.e.r.t...T.a.s.i.n.t...Y.a.n.a.s.s...Y.e.b.r.i.r...n. .t.u.f.a.t...A.s.e.g.g.a.s...C.t.e.m.b.e.[...K.r.a...a.s.s...S...i.s.a.s.s...T.a.m.r.e.c.t...D.u...e.m.b.e.[...N.u.n.e.m.b.e.[...Y.e.n.n.a.y.e.r...s.l.d... .T.......s.n.d... .T.......U.s.s.a.n. .n. .d.d.u.r.t...a.k.r.a...a.g.g.u.r. .a.m.e.n.z.u...a.k.r.a...a.g.g.u.r. .w.i.s.-.k.u.....a.k.r.a...a.g.g.u.r. .w.i.s.-.s.i.n...n. .t.u.f.a.t. ./. .n. .t.m.e.d.d.i.t...a.k.r.a...a.g.g.u.r. .w.i.s.-.k.r.a.....s.e.l.d. .t.a.l.a.l.i.t. .n. ...i.s.a...s.e.n.d. .t.a.l.a.l.i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\kam.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2064
                                                                                                                            Entropy (8bit):4.948433584060709
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:gQ4G3fYb9JqyAbjEuuhfyAuGs9aRNuynom0hjM93rjM1n5gWVuzQVnA:60YbHjxBJNcm0BEvqn5/1A
                                                                                                                            MD5:38B85F189DFA6F6AF02FF64792ED29CD
                                                                                                                            SHA1:BD7F5D6E3EA0C0774724C7C60CB2F34DEA05A980
                                                                                                                            SHA-256:88F0AFF524D91359E2D6D5518487FBB24F098756425B96E6FD63097C788D63A7
                                                                                                                            SHA-512:BD852CEADFC6A00419FD97C9D1FE597E17CB7BBEDAFB64957B574154DFE532D3EA4F66316A14D54B3C2BC633D7A76DE71751E87000690814E147A7AD34D45C06
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .6....................6.........(...I.Y...M.Y...K.e.l...K.n.d...K.t.n...K.t.i...M.b.e...M.o.o...N.y.a...W.k.l...W.k.n...W.k.w...W.k.y...W.t.h...W.t.n...W.t.i...(.k.l...(.k.m...(.k.u...h.n.)...M.w.a.i...(.y.o.o...K.y.u.m.w.a...(.v.i.n.d.a...N.d.a.t.).k.a...W.a. .k.a.n.a...W.a. .k.e.l.)...h.m.i.n.t.h.)...K.y.u.m.w.a.n.)...(.y.a.k.w.a.k.y.a...W.a. .k.a.t.a.n.o...W.a. .k.a.t.a.t.i...W.a. .k.y.u.m.w.a...L.o.v.o. .y.a. .k.a.n.a...L.o.v.o. .y.a. .k.e.l.)...L.o.v.o. .y.a. .m.b.e.e...M.b.e.e. .w.a. .Y.e.s.i...M.w.a.i. .w.a. .k.a.n.a...M.w.a.i. .w.a. .k.e.l.)...M.w.a.i. .w.a. .m.b.e.e...W.a. .t.h.a.n.t.h.a.t.i...M.w.a.i. .w.a. .k.e.n.d.a...M.w.a.i. .w.a. .).k.u.m.i...(.t.i.n.a. .w.a. .Y.e.s.i...K.).s.i.o. .k.y.a. .).s.a.a...L.o.v.o. .y.a. .k.a.t.a.t.i...M.w.a.i. .w.a. .k.a.t.a.n.o...M.w.a.i. .w.a. .k.a.t.a.t.i...M.w.a.i. .w.a. .m.u.o.n.z.a...W.a. .k.w.a.m.b.).l.).l.y.a...M.w.a.i. .w.a. .n.y.a.a.n.y.a...(.y.a.k.w.a.k.y.a./.(.y.a.w.).o.o...M.w.a.i. .w.a. .t.h.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\kam_KE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\kde.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2024
                                                                                                                            Entropy (8bit):4.901964455259392
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:GCiDWP474e4l4PjP4YRMo4oMwRMQRMKRMEl4oMCRMWRMERMfRMERMMjMFrjMpIgy:3Mt42tjVrRVHRuRbMGIgmBTmM9f
                                                                                                                            MD5:C4A9A42D870D122DB294424CDC0A8A3D
                                                                                                                            SHA1:F1CEB777A63F2301C1EAB9BA223A2DD2308017D2
                                                                                                                            SHA-256:A74EFB4AE75E0D79A479B4853DAB200CAFA59101344BC77801F0395F4080F9D1
                                                                                                                            SHA-512:0BF5982577288FE10DF77DA1CB3A54E49AB5D545B444C33A977FFCFD7F431364E0F3D773C072FD5B51C9049796527CB1D29D7802754C6E6DD23AF761EA11F481
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .m....................m.........A.Y...N.Y...L.l.1...L.l.2...L.l.3...L.l.4...L.l.5...L.l.6...L.l.7...M.u.h.i...L.i.d.o...N.e.l.o...M.w.e.d.i...N.u.n.d.u...L.i.h.i.k.u...L.i.j.u.m.a...M.a.h.i.k.u...M.u.h.i./.C.h.i.l.o...M.w.e.d.i. .N.t.a.n.d.i...M.w.e.d.i. .w.a. .P.i.l.i...M.w.e.d.i. .w.a. .T.a.t.u...N.a.n.k.u.i.d.a. .Y.e.s.u...A.k.a.n.a.p.a.w.a. .Y.e.s.u...L.i.d.u.v.a. .l.i.t.a.n.d.i...L.i.d.u.v.a. .l.y.a.p.i.l.i...L.i.d.u.v.a. .l.y.a.t.a.t.u...N.p.a.n.d.a. .w.a. .m.u.d.a...M.w.e.d.i. .w.a. .N.n.y.a.n.o...L.i.d.u.v.a. .l.y.a.n.n.y.a.n.o...M.w.e.d.i. .w.a. .N.c.h.e.c.h.i...D.i.s.i.k.u. .d.y.a. .l.i.j.u.m.a...L.i.d.u.v.a. .l.y.a.n.c.h.e.c.h.i...M.w.e.d.i. .w.a. .N.n.y.a.n.o. .n.a. .U.m.o...L.i.d.u.v.a. .l.y.a.n.n.y.a.n.o. .n.a. .l.i.n.j.i...M.w.e.d.i. .w.a. .N.n.y.a.n.o. .n.a. .M.i.t.a.t.u...M.w.e.d.i. .w.a. .N.n.y.a.n.o. .n.a. .M.i.v.i.l.i...M.w.e.d.i. .w.a. .N.n.y.a.n.o. .n.a. .N.n.y.a.n.o...L.i.d.u.v.a. .l.y.a.n.n.y.a.n.o. .n.a. .m.a.v.i.l.i...M.w.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\keyTypeData.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6876
                                                                                                                            Entropy (8bit):4.946324598732954
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:WDsNYz5J6B76OA/Ok9yNKTFEdsimwEtLVOIFyU7W/fCGrlw7vHHFoGjjeHgA2:WD1zCR88KTIm1U8y7SGkvnFo+jsy
                                                                                                                            MD5:0043D5000800EAA0476252B372BBA4D1
                                                                                                                            SHA1:C64CD761CDBBCD2925C3B128E795BF76A3DCFB59
                                                                                                                            SHA-256:9FF8B84024791426589B9454E301E7AAA5734A9471B492DB01EF2A8BBE50FDC4
                                                                                                                            SHA-512:A6EB41A175A9574D2834946B42699C36370379AC10923F8158F3C4743EAA97F4A3DB4FE2D23EE2CCED0E8E8732C2CF622016FAC6F085085A37CD104241B9BC58
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................/...........bcpTypeAlias.ca.islamicc.keyInfo.deprecated.kh.vt.valueType.h0.x0.keyMap.calendar.colalternate.colbackwards.colcasefirst.colcaselevel.colhiraganaquaternary.collation.colnormalization.colnumeric.colreorder.colstrength.currency.d0.fw.hours.i0.k0.kv.lb.lw.m0.measure.numbers.s0.t0.timezone.variabletop.typeAlias.quarternary.typeInfo.co.direct.camtr.typeMap.buddhist.chinese.coptic.dangi.ethiopic.ethiopic-amete-alem.gregorian.hebrew.indian.islamic.islamic-civil.islamic-rgsa.islamic-tbla.islamic-umalqura.iso8601.japanese.persian.roc.account.standard.non-ignorable.shifted.yes.lower.upper.big5han.compat.dictionary.ducet.emoji.gb2312han.phonebook.phonetic.pinyin.reformed.search.searchjl.stroke.traditional.unihan.zhuyin.REORDER_CODE.digit.punct.space.symbol.identical.primary.secondary.tertiary.adp.aed.afa.afn.alk.amd.ang.aoa.aok.aon.aor.arl.arm.arp.ars.ats.aud.awg.azm.azn.bad.bam.ban.bbd.bdt.bec.bef.bel.bgl.bgm.bgn.bgo.bhd.bif.bmd.bnd

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\kk_KZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\kkj.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1892
                                                                                                                            Entropy (8bit):5.089152503137751
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:58MtyDcuzJJsSxcE7OI+HCVhlms+jWoUQdijq6LrLrLzj4bo7r85FXKar:ptyDcmMSiE7haQlms+y9Qdi5LrLrLn49
                                                                                                                            MD5:68749307A2C6C01AE6022CC216368F81
                                                                                                                            SHA1:BA9781D455A957A6EFFFB3F674ACB57BB3616395
                                                                                                                            SHA-256:44AC6E5FEF29C38664BFC4468DF48895004EFC598086D024D3CF0B9C70DDABC3
                                                                                                                            SHA-512:8F2B7D8DF88AFB4E0CA634A321D5C43C0526F1FE561B1F7728E9DE5C4E2350547A0A5B01185249E9E3043827F523C29E8036F33A4B3FB7866AE3C52350C59318
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................................m.s...m.[...f.[...y.e.d.i...k.w.e.y...m.u.k.a...l.u.n.d.i...n.j.a.p.i...p.a.m.b.a...w.a.n.j.a...k.u.K.g.w.[...n.y.u.k.u.l...n.[.m.[.n.T...S.u.l.S.u.s.[...m.[.r.k.[.r.[.d.i...v.a.K.d.[.r.[.d.i...E. .d.d./.M.M. .y...m.T.n.T. .s.T.n.d.i...N.y.T.l.T.m.b.T.K.g.T...M.T.n.T. .K.g.b.a.n.j.a...m.b.i.y.T. .m.[.n.d.o.K.g.T...E. .d.d./.M.M. .y. .G.G.G.G.G...N.y.a.K.g.w.[. .K.g.b.a.n.j.a...[.,. .\.:. .!. .?. ... .& .. .9 .: .. .. ... ... .(. .). .*.].....[.A. .B. ... .C. .D. ... .{...y.}. .E. ... .F. .G. .{.G.b.}. .{.G.w.}. .H. .I. .{.I.'.}. .J. .K. .{.K.p.}. .{.K.w.}. .L. .M. .{.M.b.}. .N. .{.N.d.}. ... .{.N.y.}. .J. .{.J.g.}. .{.J.g.b.}. .{.J.g.w.}. .O. ... .{...'.}. .P. .R. .S. .T. .U. .{.U.'.}. .V. .W. .Y.].....[.a. ... ... ... .{.a.'.}. .b. .S. .c. .d. .W. .{.W.y.}. .e. ... ... ... .[. .{.[...}. .{.[...}. .{.[...}. .{.[.'.}. .f. .g. .{.g.b.}. .{.g.w.}. .h. .i. ... ... ... .{.i.'.}. .j. .k. .{.k.p.}. .{.k.w.}. .l. .m. .

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ko.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):28556
                                                                                                                            Entropy (8bit):5.803587066284139
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:Q6qtmsWbuGaJC6NcUi0ZI/Rkimpc+IO/15E3C3VSyZ7/cdkfxN7jHXgiiAX:Q6Dscx6N/Ikiecb217nbHj
                                                                                                                            MD5:4BE347054E963AB2D432D2C2CECDF9F9
                                                                                                                            SHA1:5015B7090F8D7ED7E89BF322241C5A4C153E11FB
                                                                                                                            SHA-256:1190F172A81569AF1BDB953836E40B5A2C92071803D9626B20A467CC4F4D398E
                                                                                                                            SHA-512:5FB4E40B578526A16D407B11BAD800C03E8F18E9185A121226E8EAA0F17A5170E3C786EE647A8E5110E4C6887D69741A9248CCA21A800120D8F846DC3237C0A6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................V...................$.......T...U...3.....4.....5.....6.....7.....8.....9.......$...$.........................A........... ...........x............................ ..........t..........t.....$........L.t...,......t...h.......8.....D..... ...........$.....x................. ...........$.....x.................i................... .........t.......0.....0.....0.....0. ...0.....0.....0.t...C..................$.....\...p..........|..........4. ...4.....4.$...4.x...4.....4.....1.\.... .........$....x...............0......................$.....\...+....P.H.....'.....D...................... ..........t...D....U..........D.....D.....D....D. ...D....D.t.....$.........................X...................X.....\.\...\......................t.<.....(.....1.....D.....|....<...).............<.....0.....@.....<................1........$....,.t...x.<..............X....\....1.1.....1.2.....1.0.......D.....P.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ks.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2152
                                                                                                                            Entropy (8bit):5.554526975067007
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:dakhoGlAjqSUDGtuGzRk5sYMb5I3uL6siDCeV9PGz:dJWmG8Gus95cu+ss3+z
                                                                                                                            MD5:B5AA1A313DDA20F00479F0ABDAA11F61
                                                                                                                            SHA1:D5F6FAE4416478AFBBFA1A03315F8B4AF2A6A0FC
                                                                                                                            SHA-256:0B691EEE2D844D4170AAFFC3C8966DE1E394CDD22C849DE5508F6F06FDDC550A
                                                                                                                            SHA-512:F58853302E0CAE8BEE6273C48B0F16206FB27079755BC86878F77DD197F40F08F178B5C1D90C7368BCD92C92A9F60E6CA8359484E62981B0FBCB22196CC1FEC8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ....................................'.N.2...2.H.F...E...T...,.O.E.....,.H.W.F...M./.G.y...1. .*.....1.'.*.....~...'.....(.y.H.'.1...,.F.$.1.....'... .......(... .3.....A.1.$.1.....E.'.1.U.....E.P.F.N.y.....A.*...U...(.H./.H.'.1...(...E.H.'.1...".*...H.'.1...3. ...N.F.......r.F.y...U...M.M.M.M. .G.y...(.1. .3.H.'.1...Q.Q.Q.Q. .G.y.....H.W. .'...3...'.N.*...H.'.1...'...*.H.W.(.1...,.H.W.D.'.......5.(.-./.1.'.*...E...V.y.1.P.....0.P... .'.D.B./.....A.*.O... ./.........T.F./.U.1.H.'.1...B.(.U.D. .E.3...V.-.....T.F./.1.U.1.H.'.1...E.E.E.,. .M./.d./.G.y...*.1...P.E. .....(.'...../.....P.E. .....(.'.....1.(...V.9. .'.D.'.H.D...9...V.3.H... .3.F...U.....H.W.1.P.E. .....(.'.....1.(...V.9. .'.D.+.'.F...........F...O... .....(.'.....E.E.E.,. .M.M.M. .d.,. .G.y...E.E.E.E.,. .M.M.M.M. .d.,. .G.y...[.. . .N. .O. .P. .T. .U. ._. .V. .W.].....[.. .\.-. .,. ... .%. .0 .+. .0... .1... .2... .3... .4... .5... .6... .7... .8... .9...]..._.[.!. .". .#. .r. .$. .'. .

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ksb_TZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ku.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2984
                                                                                                                            Entropy (8bit):5.341880406270565
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:7X6nloFtS2bOkPfCA2em0NVrChaLQyoJBGyvWClpb3P4Nv2R:7sloFUUOIfRm0NYhPyoZvWClVe2R
                                                                                                                            MD5:4DD3D8949DB8BA7C26990D277F7E44BF
                                                                                                                            SHA1:36FA32A8F7E779E42EFFE92BB6EBAA93EDD853D2
                                                                                                                            SHA-256:7D6B05124CD5B9A492EF5436B4945BF978CD44BEA2D20D334FC84A57E4E68976
                                                                                                                            SHA-512:7F9A59D8DB949C4AF24DA92588C7F9843B414D0B14B19D33982E7FE2D1E0F7ECE3D1A5AEC6184F1145C4C495242DF2F3AD33767C74B2DD0761F6A39004D6078E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................0................^.....n...d._...p._...s._...y._....._.....1.....2.....3.....4...B.Z...P.Z...s.l...p..._...a.v.r...g.e.l...g.u.l...h.f.....k.e.w...r.e.z...r.e._...r...b...s.e.r...s.t.....t...r...d.u.h.....r.o.....s.a.l.....r.k.....s.a.e.t...s.i.b.e...d.u._.e.m...s..._.e.m...a.d.a.r.....a.v.r...l...g.u.l.a.n...h.e.f.t.e...r.o.j.e.k.....a.r...k...r.e._.e.m.....y.e.k._.e.m.....a.r._.e.m...t...r.m.e.h...%.#.,.#.#.0...a.v.r...l.....d.e.q...q.e...g.u.l.a.n.....h.e.y.w.a.n...k.e.w.....r...p..._.p.e.r...r.e.z.b.e.r...s.a.n.i.y.e...s.e.r.d.e.m...p...n.c._.e.m...{.0.}. .r.o.j...g.e.l.a.w...j...k.e.w.....r.....p..._.p.e.r.....r.e.z.b.e.r.....t...r.m.e.h.....g.e.l.a.w...j.....r.e._.e.m.i.y.....r...b.e.n.d.a.n...s.e.r.m.a.w.e.z...{.0.}. ... .{.1.}...b.e.r.f.a.n.b.a.r...r...b.e.n.d.a.n.....s.e.r.m.a.w.e.z.....{.0.}. .a.n. .{.1.}...b.e.r.f.a.n.b.a.r.....s.a.l.a. .p.i._.t.....b.e.r... .z.a.y...n.....p.i._.t... .z.a.y...n.....h.e.y.w.a.n. .a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\kw_GB.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\agq.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):932
                                                                                                                            Entropy (8bit):4.55715791046585
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:JQEuuRPl1wFTDWny0cx4sOItXInEl+90l+3y7ElUBRXnssUNPJN/Vxnjv8JJw3UH:QuNlq0c+Atr+9c+CAUBFvaPnjvaKU5N
                                                                                                                            MD5:9BCD9030FFDB12BAAB504DDC853C35FB
                                                                                                                            SHA1:BD63B57FA203696840F4AC81D3E35CBD1C3EE816
                                                                                                                            SHA-256:96608B69E51D4C3D0EB4DA7364845064574E7EE994B78F904CBE53E52C354429
                                                                                                                            SHA-512:53299EEEFBC5DB380FCA8ED82486D4A4DCBA648A254CCF283558AE8CE8AA4F348D4355110A8E9C89CAA5FBE03FF20AF78DD7FD8BF10754511E93FA15506D9F22
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................-...........R..s..T...e...C.h.[.....D.T...s...E.g.b.....E.n.d.....T.a.m.....Z.u.l.....K.h.m.[.....M...l.a.e...U.u.d...w.....l.a.b.......m.a.l.....C.h...e.n.....D.z.a.m.[.....G.h...l.......K.p.T.l...s...L.u.s.h...a...S.u.e.d...s...S...m.a.l.....T.....k...s...Y.u.l...b.a...k...u.l...a.....t.a.l...a...K.h.K.g.e.l.e...L...w.a.n.d.....B...u.g.h.l...a...B...u.m.[.s.[.....B.h...K.g.a.l.....D.z...b.v...n.....D.z...k.p...n.....H.T.K.g.a.l...a...K.p.[.[.s.h...a...L...m.a.n.y...a...N.[...k.p.a.l.......k.[.l.[.n...a...K.p.o.t...w.g...i...K.h.t.s.T.K.k.a.K...S.h...k.p.a.n...s...V...y.[.t.n...m.....B.[...l...l.u.s...n...K.p.u.w.n.d.z.a.b.....K.h...f...l...K.s.i.....n.d...n.[.s.h...a...-...@...[.......*.7.B.X.o.....@.....'.........D.Y.......0.[.........A.M.............H.F......0......Z.l.......J............C.~.u..<..c.............R.'. ..........5..........V...L..P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ak.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1140
                                                                                                                            Entropy (8bit):4.1083465013521225
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:8XTclGV3TInR6wXBJ0lXKxMNuwPwTSGUxzrkVnfM8+kS0YUlrKAH8YZl0ui8aAAL:8TFMfy94lK0frvJ2xzqxbxzRMmwVpb
                                                                                                                            MD5:531F5712ACD4D1725A78494EA29B1B87
                                                                                                                            SHA1:A7B23C03B40C0A7FEE8FA8E34300983AACB0A16E
                                                                                                                            SHA-256:2B9981A539D7380CEF83307E1A772A982416A4BE0972873BAAD05512ECA08814
                                                                                                                            SHA-512:109DDEA80DA78C7B057CAFBC6D0CCEF971ACB8B352DAED64896124CE961C1D916A59712BD9C59EA5A1AF7B5F72FD59CB715DD0852986785A20FCB825C9D2AE8A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................,...........R..s..A.m.a.r.i.k...A.r.a.b.i.k...B.o.r.T.f.o...D.[.[.k.y.e...F.r.[.n.k.y.e...G.y.a.a.m.a.n...K.y.[.k. .k.a.s.a...U.r.d.u. .k.a.s.a...G.r.e.e.k. .k.a.s.a...I.t.a.l.y. .k.a.s.a...K.o.r.e.a. .k.a.s.a...M.a.l.a.y. .k.a.s.a...N.[.p.a.l. .k.a.s.a...S.p.a.i.n. .k.a.s.a...T.a.m.i.l. .k.a.s.a...T.[.[.k.i. .k.a.s.a...U.k.r.e.n. .k.a.s.a...B.[.[.m.i.s. .k.a.s.a...G.y.a.p.a.n. .k.a.s.a...H.a.n.g.r.i. .k.a.s.a...K.y.a.e.n.a. .k.a.s.a...P.T.l.a.n.d. .k.a.s.a...R.a.h.y.i.a. .k.a.s.a...S.w.e.d.e.n. .k.a.s.a...B.e.l.a.r.u.s. .k.a.s.a...B.e.n.g.a.l.i. .k.a.s.a...P.[.[.h.y.i.a. .k.a.s.a...R.e.w.a.n.d.a. .k.a.s.a...R.o.m.e.n.i.a. .k.a.s.a...S.o.m.a.l.i.a. .k.a.s.a...T.a.e.l.a.n.d. .k.a.s.a...V.i.[.t.n.a.m. .k.a.s.a...B.T.l.g.e.r.i.a. .k.a.s.a...G.y.a.b.a.n.i.s. .k.a.s.a...K.a.m.b.o.d.i.a. .k.a.s.a...P.u.n.g.y.a.b.i. .k.a.s.a...P.T.T.t.u.g.a.l. .k.a.s.a...I.n.d.o.n.i.h.y.i.a. .k.a.s.a...,.@...[.......*.7.B.X.o.....@.....'.........D.Y.......0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ar.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22592
                                                                                                                            Entropy (8bit):4.468208862094397
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:DrCcNmVdrwfVwrKSU5+rWV4WsfKvMh2itQhXSn4SUBBWrP:PvmVdmJ+rWORQMh2itQhMUBBYP
                                                                                                                            MD5:F1DD8B42923E9D487C11078E72AC3331
                                                                                                                            SHA1:2F57235B972662F6B2BE974EBD4D0514BCB1F650
                                                                                                                            SHA-256:079B6E33C3B23BB804B08BDB7D1608B24E622AB4F580D609B4B76619D986F4AA
                                                                                                                            SHA-512:D41490E53BFD944C03C910090EC2FC045A41E520DA02A2997E54C83278F2E2B518446D72D5AFE86B5DA89D9E092245E1C97BF8D6BC628ACAA05EC3FA862AB7C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .n....................n.....R..s..E.H.F...#.F.C.H...#.C.H.3...%.E.(.H...'.D.,.'...'.D.,.H...'.D.D.H...'.D.J.J...(.'.E.F...*.J.*.'...*.J.3.H...3.J.F.'...E.'.(.'...E.J.*.'...G.'.F.(...'.D.A.'.J...'.D.#.:.E...'.D.'.F.'...'.D.*.H.J...'.D.*.J.A...'.D.,.0.1...'.D.1.H.'...'.D.3.1.1...'.D.C.1.I...'.D.C.H.J...'.D.D.'.H...'.D.G.'.F...'.D.G.(.'...'.D.J.'.H...*.4.J.:.'...-.'.3.H.(...3.'.F.:.H...:.H.*.4.F...D.'.F.,.J...E.F./.F.,...F.'.E.(.J...'.D.(.4.*.H...%.J.E.H.,.J...'.D.%.A.J.C...'.D.%.J./.H...'.D.%.J.H.J...'.D.(.J.,.'...'.D.*.J.*.E...'.D.*.J.E.F...'.D.+.9.F.)...'.D.,.'.J.H...'.D.,.(.J.'...'.D.,.F./.J...'.D.-.+.J.)...'.D./.F.C.'...'.D.1.F./.J...'.D.1.H.F.J...'.D.3.H.3.H...'.D.3.H.:.'...'.D.3.J.1.+...'.D.A.'.F.,...'.D.C.'./.H...'.D.C.(.J.D...'.D.C.1.J.C...'.D.C.H.1.H...'.D.C.H.E.J...'.D.D.H.2.J...'.D.E.'.,.'...'.D.E.'.1.J...'.D.E.H.3.J...'.D.E.J.F./...'.D.F.H.1.H...'.D.F.H.J.1...'.D.F.J.H.J...'.D.G.J./.'...'.D.H.'.4.H...(.D.F.3.J.)...*.4.D.-.J.*...C.'.F.E.(.H.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ar_EG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):116
                                                                                                                            Entropy (8bit):3.8247927337926964
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlEF3stdo/Q5zcjCjUovDopt3Ten:Sv8ctu/D+oo7oD3an
                                                                                                                            MD5:F56605EFF043B38B0EBF7D3428ECBFF9
                                                                                                                            SHA1:6699F16768C8F9EF7BC15CCA0BFA1349F25DE493
                                                                                                                            SHA-256:F7A5378171BA8BD4578D4CC3B9F40DA87195C46B159CDA4BB898D5C12183A987
                                                                                                                            SHA-512:A90DF0317B867AA5410056D0C40B64716D692544C9F5CA8C0638AD47DBDA938E7CAF2C77EC336784C955427F466BA912D65375F9AE52280AFF2AF4FE84F2EA41
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..:....................:....R..s..'.D./.F.E.'.1.C.J.)........:......V......P.:.`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\bo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):668
                                                                                                                            Entropy (8bit):4.304507620837286
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:Fw8NzAD2aGtNFqahEbeYdQfeCdQdMMdqP12peKnzC5RmK4:F9zACaG7FqqlYdPCdQdMMdQ2MKuU
                                                                                                                            MD5:A992876928751A88F99FFC0E184E2F27
                                                                                                                            SHA1:CC1E231E926B787144ADDD06FD6C304ACF275110
                                                                                                                            SHA-256:2B23657F3FC73581052B7C120A42107F1EBA1090011F71A5924901EEC51DF4C4
                                                                                                                            SHA-512:E8FBBA388059A1418D015894E9DF31C4388EC9BD9CA49C446DE4C3890BBBB631DD440D329F2D62CC406F6A4A8154111B7B5CD1CE143B7BA4669DB00C3DE93DB8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................R..s..b...|.D...A...g.r.S...Q.r...S.z...T...c.r...V.|.Q...a.r.B.....V.|.Q...f...Q.....b.......f...Q....._..._.`...f...Q.....I.r...g.|.D...f...Q.....h.t...b.t...f.t...f...Q.....b.......a.r.B...B.f.b...T.....Q.V...r.S...G.r.`.r...f...Q.....b.......a.r.B...b...r.D...T.....Q.V...r.S...G.r.`.r...f...Q... .(.h...b.r...)...Q.V...r.S...G.r.`.r...f...Q... .(.A.z...S...L...)...Q.V...r.S...G.r.`.r...f...Q... .(.Q.V...r.S...c.S...)...*.f...S...V.b.....t.Q... .a.r.B...b.r.B.f...f.t...X...V.@.|.Q...T.`.r..._.r.S...P.|.........X.X...o.u................../E/_/-/..................t....../..{/........V....P...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\brx.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):11276
                                                                                                                            Entropy (8bit):4.99444389237807
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:RaXkdcDJSKgp/ztErYkGzgtNMArn+PoOKAbvSHZDzlf8jspiidWOianZxericy:RCSJp/JEogYAL+PoBAbvSH5zyjsp/dW2
                                                                                                                            MD5:BB1CB76BA1098799FA0259B1616D3F0F
                                                                                                                            SHA1:E9530BF2FFF771159244B78FD9A9A34497325CEF
                                                                                                                            SHA-256:021CA790C24DEB07BF720D334125FF20E54AE6EEC9C900289DC6F82A6F0D03CC
                                                                                                                            SHA-512:A04A70B23F461EE56C6875D107F9F55A6B164C8ADED4CC7DAFF48E872E679EBED1706E1B37B4C053E627161D3280B8B5C98AE2B499FDE43B0C85C47D7E1CE03A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .b....................b.....R..s............(.....!.K.....5.G.....(.B.....E.....!...M...+.K.(.......@.../.>.....0.A.....2.A.....6.>.(.....2.A.........,.>.....G...M.....@.5.M.....A.5.@...$...?.3...$...@.3...,.....@...,.!.<.K.....2.>./.....A.(.M...0.A.8.@...5.>.0./...8.>.8.....9...!.>...9...8.>.....M...G.0...(.M.....K.....!.@...G.....8.>...@.......0.?.6.....$.M.8...........A.7.....,.>.(.M.....2.K...K.....0.M.&.A.....+.@...M.....2.>...@.......9.H.......0...K.(.......@.(.M.....I.....K.....I.*.M.......<.>.8.@.....<.K.8.>.....@...<.M.....L.%.@.........$.>.......@.,...>.....<.A.(.@.....<.A.2.B.....>...0.M...!...L...>...!.A...2.>...$.@...(.G...(.>...0.B...*.....>.....*.>.2.>.....+.<.@...@...+.>.....M...+.>.....@...,.....2.>...,.0.M...@...,.2.B...@...,.A.9.@.&...,.G...,.>...,.M.2.@.(.......&.>.0.......M.8.0.....>.....A.....>...!.G.....G...&.G.....K.9.K...../...A...M...0.?...M.$...2.>...,.>...2.A...!.>...2.A.6.>.....2.K...<.@...5.>.2.A.(...5.G...!.>...5.K...@.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\bs_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9059918981668114
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMvs06E7lso5vn:Svv06gsG
                                                                                                                            MD5:D98FB5F9E283865FC645EFD43062C7A5
                                                                                                                            SHA1:BE52530BF72C9E226A6F9B01F4617DF3BAEC2CC3
                                                                                                                            SHA-256:09B1AD733085B1DF053F02EF0B65551CCEC422B344735D30ADFD2CF9941A600A
                                                                                                                            SHA-512:E1070F6CBB347011EFF23EA379583CA63742EAE2D7FAE92E4A76AB5EC77CB0133505FEA0E6C288C08D80ACB3FC2FCA916D5590728AD49C8BD2BD33321EF0B6F4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....V...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\da.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14636
                                                                                                                            Entropy (8bit):4.986354804883475
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:eDI3+dBp/najsM3SVrn9sp3iZ5H+fEAwI:eDI3+dBxnaj9Ir9shiZ5efEBI
                                                                                                                            MD5:CB82F2014998434D15EA82893A9CC67C
                                                                                                                            SHA1:F15783784912E7E184933A07DD83CCA472201A73
                                                                                                                            SHA-256:E65A3814B79141B6D109485A499661D244EB02D1BFEBD89D4B56C5D8A85622DC
                                                                                                                            SHA-512:C3D9D4AFC240E4D65302978EA0F6730BB315BA3D58115AC61CDC6BC038282FF4AA3557D2FEC5BD4AF86B1710889E57DC50A74D68FF2E00C4585BB657FC3527D8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................/.. .N......C...C.........N.....R..s..r.o.d...R.e.s.i...k.t.h.i...m.r.o.o...n.-.k.o...p.h.l.i...p.h.l.p...S.O.L.B.A...a.r.v.e.t...k.y.m.y.k...y.a.k.u.t...f...l.l.e.s...f...r...s.k...k.i.e.m.b.u...l.u.y.a.n.a...p.o.n.a.p.e...V.a.i.-.t.a.l...b.r.a.m.i.s.k...c.o.r.n.i.s.k...k.a.y.a. .l.i...l.e.t.t.i.s.k...l.i.p.o.v.a.z...o.l.d.i.r.s.k...s.u.r.s.i.l.v...s.u.t.s.i.l.v...v.a.i.d.i.k.a...w.a.l.b.i.r.i...o.l.d.g.r...s.k...a.r.u.m...n.s.k...r.o.m.e.r.t.a.l...C.h.a.m.-.t.a.l...N.. K.o.-.t.a.l...T.i.d.s.z.o.n.e...c.a.r.i.b.i.s.k...f.o.n.x.s.a.m.p...f.r.i.u.l.i.a.n...g.a.l.i.c.i.s.k...j.i.d.d.i.s.c.h...k.a.b.y.l.i.s.k...k.a.r.i.a.n.s.k...m.a.l.a.j.i.s.k...m.a.z.e.n.i.s.k...n.i.u.e.a.n.s.k...n.o.r.d.l.u.r.i...s.a.r.d.i.n.s.k...s.h.i.m.a.o.r.e...s.y.d.s.o.t.h.o...t.j.e.k.k.i.s.k...u.y.g.u.r.i.s.k...v.a.l.l.a.d.e.r...L.i.m.b.u.-.t.a.l...T.a.k.r.i.-.t.a.l...a.r.a.b.e.r.t.a.l...a.v.e.s.t.a.n.s.k...b.i.s.c.a.y.i.s.k...b.u.r.i.a.t.i.s.k...c.a.t.a.l.a.n.s.k...e.l.a.m.i.t.i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\dav.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):268
                                                                                                                            Entropy (8bit):5.857292864123356
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvXKlaDxNxROdZxCt83Dk3cTZN6l46izrxZvhtl03zj:mKlatNkJZNFJzrHvhtef
                                                                                                                            MD5:42541BF668D34C4055687EC04AC04A1C
                                                                                                                            SHA1:2796A316344F66BB7B20FCC303E40C938D1B0840
                                                                                                                            SHA-256:7BAC89A0D392FE8ED84D1C0946E69C449DFAD6FF4FEF5CED8B81DCD623613AE4
                                                                                                                            SHA-512:BA15E6273EC9A97F6F5A1ACAFACC8C596E108618CEFDEC865CCCE0FEEB8B88BC3B5E6A9460E233BA2B194733E1B45283729CE1FA2D2DAA0A1BC0B3342724C645
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................7.. ........;...;...-.......7...R..s..-.@...[.......*.7.7.B.X.o.....@.....'.........D.Y.......0.[.........A.M.............H.F........#..G.G.#.#E..H..2.G.......0.\...G....|G..s0..]#i0K0A0..}0R....#...G.#.0...\.#........V......P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\de_CH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1040
                                                                                                                            Entropy (8bit):3.968991321443151
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:Wh82Phx1IPlbRRCb6D9qFeEzARyL89t9yL89Nt4Elit4r5JnhoOn:uqjD9GzARyL89t9yL89Nt4Elit4rXPn
                                                                                                                            MD5:AE5239642F81C44DB129566D0DBCDB1E
                                                                                                                            SHA1:4B37D749E49A72170F1CB3F3275C9D06DD05BC10
                                                                                                                            SHA-256:2B0B4846F0BC15F980C4BBE47346A422F0432E3CEAB12A7D064A91A1B61A16E6
                                                                                                                            SHA-512:876B3F5AEDCC7F63279E54E472B8E1D8127304CB7FF1940A963284889D9259BB86716C0CC88780FC3FA9CB2034FB6909F691BAC5F03E95E5095D0691D762E3DA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..........................R..s..A.c.e.h.-.S.p.r.a.c.h.e...B.i.n.i.-.S.p.r.a.c.h.e...A.l.t.p.r.e.u.s.s.i.s.c.h...B.a.s.a.a.-.S.p.r.a.c.h.e...B.i.k.o.l.-.S.p.r.a.c.h.e...D.i.n.k.a.-.S.p.r.a.c.h.e...G.b.a.y.a.-.S.p.r.a.c.h.e...W.e.i.s.s.r.u.s.s.i.s.c.h...A.c.h.o.l.i.-.S.p.r.a.c.h.e...P.a.n.g.w.e.-.S.p.r.a.c.h.e...U.S. .M.a.s.s.-.S.y.s.t.e.m...K.i.m.b.u.n.d.u.-.S.p.r.a.c.h.e...N.a.d.s.c.h.d.-.A.r.a.b.i.s.c.h...b.r.i.t.i.s.c.h.e.s. .M.a.s.s.-.S.y.s.t.e.m...G.r.o.s.s.b.u.c.h.s.t.a.b.e.n. .z.u.e.r.s.t. .a.u.f.f...h.r.e.n...N.a.c.h. .G.r.o.s.s.-./.K.l.e.i.n.s.c.h.r.e.i.b.u.n.g. .s.o.r.t.i.e.r.e.n...O.h.n.e. .G.r.o.s.s.-./.K.l.e.i.n.s.c.h.r.e.i.b.u.n.g. .s.o.r.t.i.e.r.e.n...+.S.o.r.t.i.e.r.u.n.g. .n.a.c.h. .G.r.o.s.s.-. .b.z.w... .K.l.e.i.n.b.u.c.h.s.t.a.b.e.n...+.S.o.r.t.i.e.r.u.n.g. .n.a.c.h. .G.r.o.s.s.-. .o.d.e.r. .K.l.e.i.n.s.c.h.r.e.i.b.u.n.g.....+.8...$.Q.........;.....h......._.{.R...v..Q.....C......'.`.5.~......x.....5.n......[.d...o.....+.8...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\dsb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5776
                                                                                                                            Entropy (8bit):5.016333921215043
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:76VmdMnKrYWXKF5sVDYyq2rhSOVKfK3cZMA8IYN6TBQHz/OY5zjBBeYAi97h+Hcf:7GJaY90VD9q2rhDV41PZYN6MC+zlBVKW
                                                                                                                            MD5:EDBC2B2E97F3F8F678D8048E4739462C
                                                                                                                            SHA1:C8F5202885946E2422F02A477B737D705CD7B040
                                                                                                                            SHA-256:D23BB1500C3530C4836EFEFA07D92890B7474DAF81995C6F3DDC85D5EA696DEC
                                                                                                                            SHA-512:A126BB9B1960853923F19B7B9DD782F044872C4B2DC72858FA2A019A943C012EF1AB9DF4A53A03B062A54CD91179820023C158A94B86432E6CDE2D7BF4A0C88C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...........................R..s..a.r.a.b.s.k.i...t.h.a.i.s.k.i.....e.a...i.n.a...R...c.:. .{.0.}...a.r.m.e.D.s.k.i...b.u.r.m.a.s.k.i...f.i.n.a...i.n.a...j.a.p.a.D.s.k.i...l.a.o.a...i.n.a...l.a.p.a...i.n.a...m.a.n.a...i.n.a...p.j.e.n.j.e.z.e...p.o.w.a.y.k.n.e...p.r.u.s...i.n.a...p...l.a...i.n.a...t.i.b.e.t.s.k.i...B.a.t.y.D.s.k.i...a.o.n.a...i.n.a...b.u.g.i.a...i.n.a...e.t.i.o.p.i.s.k.i...g.e.o.r.g.i.s.k.i...g.o.t.i.a...i.n.a...g.r.i.c.h.i.s.k.i...k.y.r.i.l.i.s.k.i...s.a.m.o.a...i.n.a...s.i.n.d.a...i.n.a...a.o.t.i.a...i.n.a...a.r.m.e.D.a...i.n.a...b.z.e.z. .p.i.s.m.a...f.e.r.e.j.a...i.n.a...f.i.d.~.i.a...i.n.a...j.a.p.a.D.a...i.n.a...j.o.r.u.b.a...i.n.a...l.a.k.o.t.a...i.n.a...m.a.l.g.a.a...i.n.a...m.a.o.r.i.a...i.n.a...o.r.o.j.i.a...i.n.a...t.e.l.u.g.a...i.n.a...u.s.b.e.k.a...i.n.a...B.a.t.y.D.a...i.n.a...s.u.n.d.a.n.a...i.n.a...a.b.c.h.a.z.a...i.n.a...a.r.a.w.k.a.a...i.n.a...b.u.l.g.a.r.a...i.n.a...g.a.g.a.u.z.a...i.n.a...g.r.i.c.h.i.a...i.n.a...h.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ebu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):656
                                                                                                                            Entropy (8bit):4.721322213254431
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:dAp2uowhcPSHW4lzdN2uOc2yoEJvKxKGYJyome:dAYbw6PezdNd23FK5YK
                                                                                                                            MD5:CF81F872603C70192464E0687D3B6428
                                                                                                                            SHA1:E57A62000883E7A9A623522CD7F5095260B22EB9
                                                                                                                            SHA-256:187B09E4A332C22D26CD1677ACEFE79700E1442B5B419B87D47CAFDFA3F19361
                                                                                                                            SHA-512:2AAE3E71F785B6F0BE8CFAC0D1BCEA23675F114A26FE504B139A6CF52D81EE694D741D25DE6F707AC913C2AD666C366C239E0BBDC8E01C0B4E94428C36961E99
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .,h.............-.....,h....R..s..K.).e.m.b.u...K.).r.e.n.o...K.).r.u.s.i...K.).c.h.e.k.i...K.).c.h.i.n.a...K.).h.i.n.d.)...K.).s.w.i.d.i...K.).a.m.h.a.r.i...K.).a.n.j.e.m.i...K.).n.g.r.i.k.i...K.).t.h.u.n.g.u...K.).t.u.r.u.k.i...K.).f.a.r.a.n.s.a...K.).h.o.l.a.n.z.i...K.).h.u.n.g.a.r.i...K.).n.j.a.p.a.n.i...K.).u.k.r.a.n.i.a...K.).h.i.s.p.a.n.i.a...K.).t.a.i.l.a.n.d.i...K.).m.b.e.l.a.r.u.s.i...K.).n.y.a.r.w.a.n.d.a...-.@...[.......*.7._.B.X.o.....@.....'.........D.Y.......0.[.........A.M.............H.F.......bhM..h.Q.%Bh.h-hth}h.hkh.h..Rh.h.e...J.h...R..Y;. 6&.h.1e94hc;;h.h.#Zh...h.h.h..+h."Jh%.....V......P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_BM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMvs9lN/FiipU:SvvXpU
                                                                                                                            MD5:68AE567D0C236DA786E332A837C30299
                                                                                                                            SHA1:DFEDA196EF4CD20BBF63CC94D213AD031BAB3DCB
                                                                                                                            SHA-256:B008DDD5D12FB7008AC7F0C345E57100EF0A0B69F6F92CB34496C34386F71B7F
                                                                                                                            SHA-512:60E949B0AB3E6AC8209473F4C19BF87EBA3216F1DE345F93E88CBAEAF68BF6FE7CE4F2DDE4EAB9966E1DA237F644E116AB5F5DC107D846D3FC7D3971FE380734
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_CA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):344
                                                                                                                            Entropy (8bit):4.191938007824991
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:Sv2Rj0AKlS8Qlrul1qalpKlFsKUZcAN5UidrKSMFtPqhUAftafyn:HR1KlTQpuJlKs0ADCFtPqhV0fyn
                                                                                                                            MD5:712C8C9FFF630E4093112B40EBFBFA92
                                                                                                                            SHA1:2A060C611710276A50EC408CE805D4E12C0354DB
                                                                                                                            SHA-256:125D5D68E49CB23C5850941D47FEEAF6474F5422F1C07DBA9CDA16DD77CCD4B9
                                                                                                                            SHA-512:9DAA215309924F0E987E04E7DDCE842BCBBB54D633C6CC4D697A6A2E59FA1E2BF9E44ACC300BB44A6266D1BA19D080367B6FFD62474A64CE9166790DE512806D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................G.. ........N...N...........C...R..s..T.u.v.a.l.u.a.n...M.a.u.r.i.t.i.a.n...T.o. .F.u.l.l. .W.i.d.t.h...T.o. .H.a.l.f. .W.i.d.t.h...T.o. .L.o.w.e.r. .C.a.s.e...T.o. .T.i.t.l.e. .C.a.s.e...T.o. .U.p.p.e.r. .C.a.s.e......... .)....*)..........b.......r...x...................c..Ph..P..j.....V......`Z..PC.. #0.`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_CK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMvs9lN/FiipU:SvvXpU
                                                                                                                            MD5:68AE567D0C236DA786E332A837C30299
                                                                                                                            SHA1:DFEDA196EF4CD20BBF63CC94D213AD031BAB3DCB
                                                                                                                            SHA-256:B008DDD5D12FB7008AC7F0C345E57100EF0A0B69F6F92CB34496C34386F71B7F
                                                                                                                            SHA-512:60E949B0AB3E6AC8209473F4C19BF87EBA3216F1DE345F93E88CBAEAF68BF6FE7CE4F2DDE4EAB9966E1DA237F644E116AB5F5DC107D846D3FC7D3971FE380734
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_ER.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMvs9lN/FiipU:SvvXpU
                                                                                                                            MD5:68AE567D0C236DA786E332A837C30299
                                                                                                                            SHA1:DFEDA196EF4CD20BBF63CC94D213AD031BAB3DCB
                                                                                                                            SHA-256:B008DDD5D12FB7008AC7F0C345E57100EF0A0B69F6F92CB34496C34386F71B7F
                                                                                                                            SHA-512:60E949B0AB3E6AC8209473F4C19BF87EBA3216F1DE345F93E88CBAEAF68BF6FE7CE4F2DDE4EAB9966E1DA237F644E116AB5F5DC107D846D3FC7D3971FE380734
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_GH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMvs9lN/FiipU:SvvXpU
                                                                                                                            MD5:68AE567D0C236DA786E332A837C30299
                                                                                                                            SHA1:DFEDA196EF4CD20BBF63CC94D213AD031BAB3DCB
                                                                                                                            SHA-256:B008DDD5D12FB7008AC7F0C345E57100EF0A0B69F6F92CB34496C34386F71B7F
                                                                                                                            SHA-512:60E949B0AB3E6AC8209473F4C19BF87EBA3216F1DE345F93E88CBAEAF68BF6FE7CE4F2DDE4EAB9966E1DA237F644E116AB5F5DC107D846D3FC7D3971FE380734
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_GM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMvs9lN/FiipU:SvvXpU
                                                                                                                            MD5:68AE567D0C236DA786E332A837C30299
                                                                                                                            SHA1:DFEDA196EF4CD20BBF63CC94D213AD031BAB3DCB
                                                                                                                            SHA-256:B008DDD5D12FB7008AC7F0C345E57100EF0A0B69F6F92CB34496C34386F71B7F
                                                                                                                            SHA-512:60E949B0AB3E6AC8209473F4C19BF87EBA3216F1DE345F93E88CBAEAF68BF6FE7CE4F2DDE4EAB9966E1DA237F644E116AB5F5DC107D846D3FC7D3971FE380734
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.122089260374425
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMSlnlplljiipGVn:SvJlzpGV
                                                                                                                            MD5:C62D4F1855B9133E54519F7322687081
                                                                                                                            SHA1:E7C422A92CAEA78634BC95E88ABB76FDE5EF14C7
                                                                                                                            SHA-256:E777249A4B349B6BFB99E51CBD9A17EF3B904DA98B289A1148083827D1AD3D5A
                                                                                                                            SHA-512:6D08FE1B695CD1336DD18B270B67B2A18C50FC777DA89AA72C4E02976FF716CFAC7A2C854354A9576568367E57B132BCA7DAE1CD067E85A57434C5FFA701FA8B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.$0...................$0....R..s....j.V...#0

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_IE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMvs9lN/FiipU:SvvXpU
                                                                                                                            MD5:68AE567D0C236DA786E332A837C30299
                                                                                                                            SHA1:DFEDA196EF4CD20BBF63CC94D213AD031BAB3DCB
                                                                                                                            SHA-256:B008DDD5D12FB7008AC7F0C345E57100EF0A0B69F6F92CB34496C34386F71B7F
                                                                                                                            SHA-512:60E949B0AB3E6AC8209473F4C19BF87EBA3216F1DE345F93E88CBAEAF68BF6FE7CE4F2DDE4EAB9966E1DA237F644E116AB5F5DC107D846D3FC7D3971FE380734
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_IO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMvs9lN/FiipU:SvvXpU
                                                                                                                            MD5:68AE567D0C236DA786E332A837C30299
                                                                                                                            SHA1:DFEDA196EF4CD20BBF63CC94D213AD031BAB3DCB
                                                                                                                            SHA-256:B008DDD5D12FB7008AC7F0C345E57100EF0A0B69F6F92CB34496C34386F71B7F
                                                                                                                            SHA-512:60E949B0AB3E6AC8209473F4C19BF87EBA3216F1DE345F93E88CBAEAF68BF6FE7CE4F2DDE4EAB9966E1DA237F644E116AB5F5DC107D846D3FC7D3971FE380734
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_KN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMvs9lN/FiipU:SvvXpU
                                                                                                                            MD5:68AE567D0C236DA786E332A837C30299
                                                                                                                            SHA1:DFEDA196EF4CD20BBF63CC94D213AD031BAB3DCB
                                                                                                                            SHA-256:B008DDD5D12FB7008AC7F0C345E57100EF0A0B69F6F92CB34496C34386F71B7F
                                                                                                                            SHA-512:60E949B0AB3E6AC8209473F4C19BF87EBA3216F1DE345F93E88CBAEAF68BF6FE7CE4F2DDE4EAB9966E1DA237F644E116AB5F5DC107D846D3FC7D3971FE380734
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_MG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMvs9lN/FiipU:SvvXpU
                                                                                                                            MD5:68AE567D0C236DA786E332A837C30299
                                                                                                                            SHA1:DFEDA196EF4CD20BBF63CC94D213AD031BAB3DCB
                                                                                                                            SHA-256:B008DDD5D12FB7008AC7F0C345E57100EF0A0B69F6F92CB34496C34386F71B7F
                                                                                                                            SHA-512:60E949B0AB3E6AC8209473F4C19BF87EBA3216F1DE345F93E88CBAEAF68BF6FE7CE4F2DDE4EAB9966E1DA237F644E116AB5F5DC107D846D3FC7D3971FE380734
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_NF.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMunl5jiipS:Svv7pS
                                                                                                                            MD5:8CCD09FD382B155E658CB8E38A69D50D
                                                                                                                            SHA1:BEB2F210E55B9B72116CB9CA3B5A654E7BBF3066
                                                                                                                            SHA-256:673B9967E9BAB1BAB7BD65E184EEB02EB5E8DC38F33F0970E683B9445C967CC7
                                                                                                                            SHA-512:26D1444AC0D0DC7BD1A5E5081BDCE4831FB7768D6C93747E6BAE049D88136A95D13644763AAA86E4DEA7CFC40A6D2EF80506A984E650DEBC3C036822D881282A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_NR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMunl5jiipS:Svv7pS
                                                                                                                            MD5:8CCD09FD382B155E658CB8E38A69D50D
                                                                                                                            SHA1:BEB2F210E55B9B72116CB9CA3B5A654E7BBF3066
                                                                                                                            SHA-256:673B9967E9BAB1BAB7BD65E184EEB02EB5E8DC38F33F0970E683B9445C967CC7
                                                                                                                            SHA-512:26D1444AC0D0DC7BD1A5E5081BDCE4831FB7768D6C93747E6BAE049D88136A95D13644763AAA86E4DEA7CFC40A6D2EF80506A984E650DEBC3C036822D881282A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_NZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):96
                                                                                                                            Entropy (8bit):3.4276942711037677
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tluF52lFvlullUl/Ea2KLFEMPFn:Sv6olulGl/dx39n
                                                                                                                            MD5:29DA2B969A3B0DAAE6D2A48DAC054B11
                                                                                                                            SHA1:53678CE43622FF0127B74A4ECE3A3A2AA55D1FAE
                                                                                                                            SHA-256:391E2AE69142FC9833DD66DCE35878EDB160A599ABAB90AF3B44AE4F76103831
                                                                                                                            SHA-512:C9DAFE0F301433C1DC03C063606A2F7787CCEC61DD42423630FC4EB54C3E5D5A24F5C007DB70C6AE33E9A824AA0DBD5C78C5CC39715FA075695168C43D9939E3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .$0...................$0....R..s......g...j...V....`...P#0.`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_PH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMunl5jiipS:Svv7pS
                                                                                                                            MD5:8CCD09FD382B155E658CB8E38A69D50D
                                                                                                                            SHA1:BEB2F210E55B9B72116CB9CA3B5A654E7BBF3066
                                                                                                                            SHA-256:673B9967E9BAB1BAB7BD65E184EEB02EB5E8DC38F33F0970E683B9445C967CC7
                                                                                                                            SHA-512:26D1444AC0D0DC7BD1A5E5081BDCE4831FB7768D6C93747E6BAE049D88136A95D13644763AAA86E4DEA7CFC40A6D2EF80506A984E650DEBC3C036822D881282A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_PK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMunl5jiipS:Svv7pS
                                                                                                                            MD5:8CCD09FD382B155E658CB8E38A69D50D
                                                                                                                            SHA1:BEB2F210E55B9B72116CB9CA3B5A654E7BBF3066
                                                                                                                            SHA-256:673B9967E9BAB1BAB7BD65E184EEB02EB5E8DC38F33F0970E683B9445C967CC7
                                                                                                                            SHA-512:26D1444AC0D0DC7BD1A5E5081BDCE4831FB7768D6C93747E6BAE049D88136A95D13644763AAA86E4DEA7CFC40A6D2EF80506A984E650DEBC3C036822D881282A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_RH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.669445111603312
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlKelBjlgljl/Fipp/n:SBtkJTl4q/
                                                                                                                            MD5:4EB66956A148CB004F63FA8031FFE6EE
                                                                                                                            SHA1:2D9A7D385489C3479F04F43313E56873218AA174
                                                                                                                            SHA-256:F79055B8606BC0A3CE2F413EA242849AABDB1EE2B7232C37C61F9EE2EFBF2D1F
                                                                                                                            SHA-512:18AD6A6B83DD9F507BA3981E4C74C15F964B1CB10869BB51AFD89321C818CC2AB6352B61A767C83CB2D23AB276E3A8637E6F9A430255B67BD9B83D7CD2F6505F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s..e.n._.Z.W.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_SC.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMunl5jiipS:Svv7pS
                                                                                                                            MD5:8CCD09FD382B155E658CB8E38A69D50D
                                                                                                                            SHA1:BEB2F210E55B9B72116CB9CA3B5A654E7BBF3066
                                                                                                                            SHA-256:673B9967E9BAB1BAB7BD65E184EEB02EB5E8DC38F33F0970E683B9445C967CC7
                                                                                                                            SHA-512:26D1444AC0D0DC7BD1A5E5081BDCE4831FB7768D6C93747E6BAE049D88136A95D13644763AAA86E4DEA7CFC40A6D2EF80506A984E650DEBC3C036822D881282A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_SG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMunl5jiipS:Svv7pS
                                                                                                                            MD5:8CCD09FD382B155E658CB8E38A69D50D
                                                                                                                            SHA1:BEB2F210E55B9B72116CB9CA3B5A654E7BBF3066
                                                                                                                            SHA-256:673B9967E9BAB1BAB7BD65E184EEB02EB5E8DC38F33F0970E683B9445C967CC7
                                                                                                                            SHA-512:26D1444AC0D0DC7BD1A5E5081BDCE4831FB7768D6C93747E6BAE049D88136A95D13644763AAA86E4DEA7CFC40A6D2EF80506A984E650DEBC3C036822D881282A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_SI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1626531665973814
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMunl5jiHrUL:SvvtL
                                                                                                                            MD5:5FAB5876AF089CE3960AC8BF4CB51AAE
                                                                                                                            SHA1:56C1B74B88F869696057C30CB38F2BB0B6A963FB
                                                                                                                            SHA-256:968FDFFF72C8DD5A2C26F14DC6287839DCC1AA401AA16205ACC50C4A0B2F4AEA
                                                                                                                            SHA-512:35287FCB5DD420CFE9F520AF55C36C00AB20B0FD4AD48BB50CAC19917F9E87ED77AF4585BDB2105495F06147DBBFB85BF5C5FB44326488130B13C936D9B822FC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.|...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_SX.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMunl5jiipS:Svv7pS
                                                                                                                            MD5:8CCD09FD382B155E658CB8E38A69D50D
                                                                                                                            SHA1:BEB2F210E55B9B72116CB9CA3B5A654E7BBF3066
                                                                                                                            SHA-256:673B9967E9BAB1BAB7BD65E184EEB02EB5E8DC38F33F0970E683B9445C967CC7
                                                                                                                            SHA-512:26D1444AC0D0DC7BD1A5E5081BDCE4831FB7768D6C93747E6BAE049D88136A95D13644763AAA86E4DEA7CFC40A6D2EF80506A984E650DEBC3C036822D881282A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_VC.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMunl5jiipS:Svv7pS
                                                                                                                            MD5:8CCD09FD382B155E658CB8E38A69D50D
                                                                                                                            SHA1:BEB2F210E55B9B72116CB9CA3B5A654E7BBF3066
                                                                                                                            SHA-256:673B9967E9BAB1BAB7BD65E184EEB02EB5E8DC38F33F0970E683B9445C967CC7
                                                                                                                            SHA-512:26D1444AC0D0DC7BD1A5E5081BDCE4831FB7768D6C93747E6BAE049D88136A95D13644763AAA86E4DEA7CFC40A6D2EF80506A984E650DEBC3C036822D881282A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\es.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12784
                                                                                                                            Entropy (8bit):4.96045176959317
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:fTMM72/mH35LgEa+RnlzW38om5XUStWVrTTz9OzhA:fTMw2/mH350Ea+BlzW38p5kV/TxO1A
                                                                                                                            MD5:8EEC3EF01342E4CD74486C78BE02FCB4
                                                                                                                            SHA1:C15BCD17EDD1FC382B47F22D87CDD1240F2D12C0
                                                                                                                            SHA-256:5F608694E055285782BB6A0DCEF6658C3C6986848B7736D377ED5E16A37EE8BE
                                                                                                                            SHA-512:BED460BB30C594A24E3AC0C98C26481B4656CCE978DCF2051E3EB6FBE079C80E0FE9944C532FF8225A3468D0BA221C01A2C457B54470B141FBCD8DFD005DE8DA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................`.. ........t...t...........7...R..s..e.w.....m.a.r.....r.a...z...z.u...i...c.o.p.t.o...b.a.m...n...c.a.r.i.o...f.i.n...s...l.i.c.i.o...l.i.d.i.o...m.a.s...i...p.a.s.t.....u.y.g.u.r...w...l.o.f...y.a.p...s...y.i.d.i.s...g...t.i.c.o...a.d.i.g.u.....a.r.a.m.e.o...a.s.a.m...s...b.a.s.k.i.r...b.o.s.n.i.o...c.a.b.i.l.a...e.m.o.j.i.s...k.a.z.a.j.o...m.a.l.a.y.o...m.a.n.c.h.....m.a.n.d.e.o...m.a.r.a.t.....p.a.s.t...n...r...n.i.c.o...s.e.r.b.i.o...t.a.y.i.k.o...t.r.u.k...s...u.z.b.e.k.o...v...t.i.c.o...f.e.n.i.c.i.o...j.a.v.a.n...s...a.b.j.a.s.i.o...b.u.r.i.a.t.o...c.a.r.e.l.i.o...c.a.s.u.b.i.o...c.h.e.y.e.n.e...e.s.t.o.n.i.o...f.i.y.i.a.n.o...g.a.g.a.u.z.o...g.a.l.l.e.g.o...k.i.r.g.u...s...k.o.n.k.a.n.....k.o.t.a.n...s...k.u.t.c.h.i.n...m.a.c.a.s.a.r...n.o.r.u.e.g.o...n...m.e.r.o.s...o.l. .c.i.k.i...o.s...t.i.c.o...p.a.n.y.a.b.....s.o.n.i.n.k.....s.u.m.e.r.i.o...t.i.g.r.i...a...w.o.l.a.y.t.a...s.u.n.d.a.n...s...a.v...s.t.i.c.o...a.r.r.u.m.a.n.o...a.r.a.h.u.a.c.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\es_AR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):148
                                                                                                                            Entropy (8bit):4.703899311765253
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlzcoZWtFiAkVAobkP1LbzMzHeonwyWn8V2ZGlej:Sv4oUpOw9LbIbnwzn87Mj
                                                                                                                            MD5:7694951EF25993C308C192CB7F702A4D
                                                                                                                            SHA1:65C2B02876FB4C07EF7639D251C32E3752CFE22A
                                                                                                                            SHA-256:ABBDCFF69A749E45C85EB908F6228F7A2AA7626CA79A8BB34193C6C56099A41D
                                                                                                                            SHA-512:7DE1EEDC81EA2FBD7609014F999BE352059DCCEBC7F14637D84F7B3E51CACD7CD17F2BB9D43D074078951C69911BC7EC8591D2330C02C73922A695763D356FD1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................R..s..........{...z.L.[.....*.....}......F....X..........""......j...V....`...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\es_BR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMunl5jixpUL:SvvtL
                                                                                                                            MD5:D1ED7E86954B36EC7A46716615E51424
                                                                                                                            SHA1:C24BB9669785D7CEC7C6957AE7701AF0171AE313
                                                                                                                            SHA-256:A45E28E4DB331EE08EB719CDEE2870608B96B0DF6E7B650E71AC6ACB24C18624
                                                                                                                            SHA-512:E341F2A7B63D4D031D6E2172653D1E36183EFE71D07EBFCC7124C82358ED3EB93EC46ED926E9FDC0B4F30EAE2027D46B614717CB5FB2F9C596D801C74267F9F0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\es_BZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1220892603744246
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMunl5jixpUL:SvvtL
                                                                                                                            MD5:D1ED7E86954B36EC7A46716615E51424
                                                                                                                            SHA1:C24BB9669785D7CEC7C6957AE7701AF0171AE313
                                                                                                                            SHA-256:A45E28E4DB331EE08EB719CDEE2870608B96B0DF6E7B650E71AC6ACB24C18624
                                                                                                                            SHA-512:E341F2A7B63D4D031D6E2172653D1E36183EFE71D07EBFCC7124C82358ED3EB93EC46ED926E9FDC0B4F30EAE2027D46B614717CB5FB2F9C596D801C74267F9F0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....j.V.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\es_EC.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):148
                                                                                                                            Entropy (8bit):4.703899311765253
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlzcoZWtFiAkVAobkP1LbzMzHeonwyWn8V2ZGlej:Sv4oUpOw9LbIbnwzn87Mj
                                                                                                                            MD5:7694951EF25993C308C192CB7F702A4D
                                                                                                                            SHA1:65C2B02876FB4C07EF7639D251C32E3752CFE22A
                                                                                                                            SHA-256:ABBDCFF69A749E45C85EB908F6228F7A2AA7626CA79A8BB34193C6C56099A41D
                                                                                                                            SHA-512:7DE1EEDC81EA2FBD7609014F999BE352059DCCEBC7F14637D84F7B3E51CACD7CD17F2BB9D43D074078951C69911BC7EC8591D2330C02C73922A695763D356FD1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................R..s..........{...z.L.[.....*.....}......F....X..........""......j...V....`...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\es_PA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):148
                                                                                                                            Entropy (8bit):4.703899311765253
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlzcoZWtFiAkVAobkP1LbzMzHeonwyWn8V2ZGlej:Sv4oUpOw9LbIbnwzn87Mj
                                                                                                                            MD5:7694951EF25993C308C192CB7F702A4D
                                                                                                                            SHA1:65C2B02876FB4C07EF7639D251C32E3752CFE22A
                                                                                                                            SHA-256:ABBDCFF69A749E45C85EB908F6228F7A2AA7626CA79A8BB34193C6C56099A41D
                                                                                                                            SHA-512:7DE1EEDC81EA2FBD7609014F999BE352059DCCEBC7F14637D84F7B3E51CACD7CD17F2BB9D43D074078951C69911BC7EC8591D2330C02C73922A695763D356FD1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................R..s..........{...z.L.[.....*.....}......F....X..........""......j...V....`...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\es_PR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):120
                                                                                                                            Entropy (8bit):4.1134542664636
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlEFQClp/pll4ll7l/F0cCkcLr41mlP3yzGlej:Sv8QxlL9NC5f4slPRMj
                                                                                                                            MD5:333196AABE6F149A5546009212E23480
                                                                                                                            SHA1:36D233968097B9679813AFA6029362BED4AE5232
                                                                                                                            SHA-256:53DF05E03D09494FEE29761CE28447301C3B4E4CE6F28984C18597701B0AFE52
                                                                                                                            SHA-512:EF4B0CA74B266AA1E46F12512C541992E4BC81AAA88668D64CD920476B32F09698528124CC5542108D850192F215A755B7F67106AF56D7498DCC25316CA95CDF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................R..s............L..........F..........j...V....`...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ff_CM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.905547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/EnlyMmllY3:SBtkJYlU8g8l/0Enl2
                                                                                                                            MD5:14836CAA5D41214A638652DF6DECC415
                                                                                                                            SHA1:E67611755B621579CE52F7AE85B3B24F7FF9E345
                                                                                                                            SHA-256:32E71BDB4306BFDC5A464475A9B7AD9E6371B6E97B6AEB4E68957277356B6EE2
                                                                                                                            SHA-512:E14264E16FB6DEAE22ADB09A4E9B1542B8355EABD4AF4181348B7BC3DF343F342E74D0AF7D8685866CFC568F45D9D91FBEEBE683FB7B8B3C3C7616749FF1AE42
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s..f.f._.L.a.t.n._.C.M...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ff_Latn_SN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.411243631352237
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/E9:SBtkJ1li6gml/o
                                                                                                                            MD5:A0E7F0023EFE9D9DA802A0C5A941F8CE
                                                                                                                            SHA1:E4522C97B99704605469449C21AEEF8E03A0AD3E
                                                                                                                            SHA-256:756032017E2D9DEB9EC1508DAFB605009EADF6D859FF309BBCD6E49BB2D8D9F2
                                                                                                                            SHA-512:2B06564FB675F51D96E9945A303D9AADAEABB8173222AC644AC3415D5AC1AEC958D70F651A5C85561CDD79E0F4B713D43117332A8536A251F4FB48800076AB01
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....s...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\fil_PH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.411243631352237
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/E9:SBtkJ1li6gml/o
                                                                                                                            MD5:A0E7F0023EFE9D9DA802A0C5A941F8CE
                                                                                                                            SHA1:E4522C97B99704605469449C21AEEF8E03A0AD3E
                                                                                                                            SHA-256:756032017E2D9DEB9EC1508DAFB605009EADF6D859FF309BBCD6E49BB2D8D9F2
                                                                                                                            SHA-512:2B06564FB675F51D96E9945A303D9AADAEABB8173222AC644AC3415D5AC1AEC958D70F651A5C85561CDD79E0F4B713D43117332A8536A251F4FB48800076AB01
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....s...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\fy.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14776
                                                                                                                            Entropy (8bit):4.840756604653443
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:hJNBzw2ACimx6yZC+K+9giVGNXNIlHR4y0Md:hpw2Axc8+D9giVGlqlxr0Md
                                                                                                                            MD5:F5F4D042FDC414E3183D7399D30DCC21
                                                                                                                            SHA1:6F76082CB6843BB118F6156D4BA36520FBAB740E
                                                                                                                            SHA-256:3D03654780FA44F252203D81F6408453ECF5878B8BF9DDEC3FD55E1F12F7180C
                                                                                                                            SHA-512:5421635DAA2AD03336B2FACEF1AC8D0BBD635B6B21C6A2A2E97E66139F496BF3895E4749493A666EB7FC67A44CBCDD9F4788A9A4947B9EA127C837D164D6CABA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................S.. ........f...f...........@...R..s..T.h.a.i.s...E.r.z.j.a...F.i.n.s.k...G.r.y.k.s...I.e.r.s.k...K.a.d.d.o...M.a.n.k.s...W.a.a.l.s...W.e.l.s.k...B.a.m.o.u.n...J.a.p.a.n.s...D.e.e.n.s.k...D.e.f.a.k.a...F.i.j.y.s.k...K.a.r.y.s.k...L.y.c.y.s.k...L.y.d.y.s.k...M.e.i.t.e.i...N.d.y.u.k.a...N.g.u.m.b.a...P.o.a.l.s.k...S.c.h.o.t.s...S.i.f.e.r.s...S.o.e.s.o.e...S.o.r.a.n.....V.o.t.y.s.k...Y.a.p.e.e.s...Y.s.l...n.s...Z.w.e.e.d.s...G.o.t.h.y.s.k...K.o.p.t.y.s.k...A.l.d.y.r.s.k...A.t.j.e.e.s.k...A.v.a.r.y.s.k...B.a.s.k.y.s.k...B.i.r.m.e.e.s...B.o.s.n.y.s.k...I.n.g.o.e.s.j...J.a.k.o.e.t.s...J.i.d.d.y.s.k...K.a.z.a.c.h.s...K.o.e.m.u.k.s...L.e.t.l...n.s...L.e.z.g.y.s.k...L.i.t.o.u.w.s...P.a.s.j.t.o.e...S.e.r.v.y.s.k...S.o.g.d.y.s.k...S.y.p.r.y.s.k...G.e.o.r.g.y.s.k...J.a.v.a.a.n.s.k...A.k.k.a.d.y.s.k...A.l.d.g.r.y.k.s...A.l.g.e.m.e.e.n...A.m.h.a.a.r.s.k...A.s.t.u.r.y.s.k...A.v.e.s.t.y.s.k...B.r.e.t.o.n.s.k...E.s.t.l...n.s.k...F.o.n.x.s.a.m.p...F.r.i.u.l.y.s.k...G.a.l.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\gu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20092
                                                                                                                            Entropy (8bit):4.855693996462605
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:F8X8PaGAAN5vyDXDaChncUz3JWeZGbF8gxhkpvaS9F1JThwmHu5sqq5btOSdAEtj:BwaybFhc6UeZE0pb9jq5Cx1LsUF6M3K8
                                                                                                                            MD5:88DC09227190A877FD3B7B59F5A3B597
                                                                                                                            SHA1:CC502C320A980DA9BD22550A8BDD90327D0E1446
                                                                                                                            SHA-256:D00FCBC59AE2D34574BC70349A15C2CEDCA249DECCDFCBC099087AFA192A2EF8
                                                                                                                            SHA-512:6B41D92BED4F6F47A402F57D985AE2A64BB232A89F75E18F7C206AD04464B847697012219ACD5DEBAC7F4232841920203672FDAB8568F43A26AA762C41E5EA9D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................Z...R..s....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\gv.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.3516541400530713
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlzFCl9fp/SQiklJZl/olztyIj:SvE+ql3k1j
                                                                                                                            MD5:68124374E27B7809D664A5B4562CBA66
                                                                                                                            SHA1:1311DF721CD70595FDAD6EDF2A226AF8C14FBB95
                                                                                                                            SHA-256:F5FB695CBB748F1DF0543F4D43C2E11FEEFE2F5D33937E3A0FE18AE04A9B8897
                                                                                                                            SHA-512:CC21813B79F39F146B9884526674D46BA4397637772C27506FCD5E61E6A5A65D1DFD1332D892F7ACAFDDCC21EE6C8D854E24E9372DA61E92D1598C6C7FEF16FE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................R..s..G.a.e.l.g.............V......P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\haw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):996
                                                                                                                            Entropy (8bit):4.157413336009666
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:CdIOe7CUb4RYTdelO1PKAIU8MFLnvRJSPS6Nc5/AFO5cTKO:CO7C6jdfPC3ULZMS6NYcTKO
                                                                                                                            MD5:53FD129A992BD3F16612790C1D0DA1BC
                                                                                                                            SHA1:AD5FB46561E82B58384C939A443869E471AF3476
                                                                                                                            SHA-256:97B1AF616923A81BC5DA04B4F6D8EE4963D245001D9EFDDD2D5AACF4D5AD1C1F
                                                                                                                            SHA-512:ED8BED7846D5CF756FC283EEB4F74D2BA3F4ACD0828FB37FB5270320582DF13204AF33C4B2CBDC41898EA37A4070FEECD808862E754329CBCB838ED51A71BFF6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .1..............%.....1.....R..s..P...k.....P.+.k.+...W.a.l.e...K...m.o.a...K.M.l.e.a...L.k.k.i.a...H.e.b.e.r.a...H.e.l.e.n.e...K.e.p.a.n.+...L...k.i.n.a...P.a.l.a.n.i...P.u.k.i.k.+...K.u.e.k.e.n.e...P.a.n.i.o.l.o.....A.i.l.i.k.i.....A.l.a.p.i.a.....*.k...l.i.a...K.e.n.e.m.a.k.a...P.o.l.a.p.o.l.a...K.u.i.k.i.l.a.n.i...P.e.l.e.k...n.i.a...W.i.e.k.a.n.a.m.a...P...k... .K.u...u.n.a...P.a.l.a.n.i. .K.a.n.a.k.......L.l.e.l.o. .H.a.w.a.i...i...P.e.l.e.k...n.e. .K.a.n.a.k.....P.u.k.i.k.+. .P.a.l.a.k.i.l.a...P.e.l.e.k...n.e. .N.k. .H.M.l.a.n.i...P.e.l.e.k...n.i.a. .P.e.k.e.k...n.e...P.e.l.e.k...n.i.a. ...A.m.e.l.i.k.a...K.u.i.k.i.l.a.n.i. .K.e.l.e.m...n.i.a...P...k... .H.o...o.m.a...a.l.a.h.i. ...i.a...*..I.k.e. ...o.l.e. .. i.a. .a. .k.k.p.o.n.o. ...o.l.e. .p.a.h.a. .k.a. ...M.l.e.l.o...%.[.....7.B.X.....o.u.o.........@...o.......Y.....0.............(...H.........<...a.Z.......1.D...7.o.....W..S...a.G.h.g.*.v...M.A.}.0......2.k........V...|..Pg%.`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\he_IL.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.411243631352237
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/E9:SBtkJ1li6gml/o
                                                                                                                            MD5:A0E7F0023EFE9D9DA802A0C5A941F8CE
                                                                                                                            SHA1:E4522C97B99704605469449C21AEEF8E03A0AD3E
                                                                                                                            SHA-256:756032017E2D9DEB9EC1508DAFB605009EADF6D859FF309BBCD6E49BB2D8D9F2
                                                                                                                            SHA-512:2B06564FB675F51D96E9945A303D9AADAEABB8173222AC644AC3415D5AC1AEC958D70F651A5C85561CDD79E0F4B713D43117332A8536A251F4FB48800076AB01
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....s...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\hr.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):16268
                                                                                                                            Entropy (8bit):4.755787811668944
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:ck8QVzI/zb0V2l4KIZuDT85XYvuyLUIiiJrLX:ck8QVzI/30o4KIZP5QuwviiJrLX
                                                                                                                            MD5:8F650AD8EAB2EACCA9B1F63DB48CADB4
                                                                                                                            SHA1:DA29CDC66F54A53654C9775A72308E1F417DB129
                                                                                                                            SHA-256:28FF9143E71F9199738A95DA1BDBE9ECD6481FEEE13E80BA6CFA5E78F27B3FEF
                                                                                                                            SHA-512:FE4CCAE23A658E1D2630A3F430524FCC76E5446127BA71F44D6A9D120780820670E8253CE84333EA79F3F5AED4FA3864ABD4E70CCF57BC460128B3AB4F8BF2C2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...........................R..s..U.s.k.i...k.a.j.e...a...o.l.i...h.a.i.d.i...r.e.s.i.a.n...s.r.p.s.k.i...v.o.t.s.k.i...`.i.r.o.k.i...o.r.o.m.s.k.i...a.i.n.u.s.k.i...a.k.a.d.s.k.i...a.k.a.n.s.k.i...b.r.a.j.i.c.a...f.e.n.i...k.i...h.i.n.d.s.k.i...k.o.r.n.s.k.i...k.u.r.u.a.k.i...n.a.u.r.s.k.i...n.i.u.j.s.k.i...n.u.e.r.s.k.i...o.s.e.t.s.k.i...s.a.r.d.s.k.i...s.i.n.d.s.k.i...t.e.l.u.a.k.i...t.i.f.i.n.a.r...R.a...u.n.a.l.o...Y.i. .p.i.s.m.o...a.j.m.a.r.s.k.i...a.r.a.v.a...k.i...b.a.m.u.n.s.k.i...b.i.k.o.l.s.k.i...b.u.g.i.n.s.k.i...f.e.r.o.j.s.k.i...g.a.g.a.u.s.k.i...h.e.t.i.t.s.k.i...j.a.k.u.t.s.k.i...j.o.r.u.p.s.k.i...k.a.b.i.l.s.k.i...k.a.a.u.p.s.k.i...k.o.r.z.i...k.i...l.e.z.g.i.a.k.i...l.i.t.a.v.s.k.i...m.a.r.i.j.s.k.i...m.o.n.o.t.o.n.o...p.o.l.i.t.o.n.o...r.a.p.a. .n.u.i...s.e.s.o.t.s.k.i...t.i.b.e.t.s.k.i...t.i.g.r.i.a.k.i...t.u.v.i.n.s.k.i...v.a.l.o.n.s.k.i...N.u.m.e.r.i...k.i...a.k.a.d.e.m.s.k.i...a.r.o.m.u.n.s.k.i...a.v.e.s.t.i...k.i...e.m.o.t.i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\id.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15064
                                                                                                                            Entropy (8bit):4.939742695791492
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:xOTzT0uwmfbiJccuneogXhHOvVRLuBHVWFj9mju7q9RtyJ7zcWdd:x0wmziJccunLgXhHOWIj9mjum9zyXcW7
                                                                                                                            MD5:26190B9EED710094BBBC1092E660A258
                                                                                                                            SHA1:947AFD31057104A7B345F97F7B75B248D82F1A8F
                                                                                                                            SHA-256:2F152BAF2D1D1FE0E2400A39DF9E62501EA89F8686428B7E6481E93D843E92BB
                                                                                                                            SHA-512:FA1EF8360C77E869B626D10BBF1D1B7FE3565CA37E3CF5E3A8D545195DEC3D208DAB601F84FDD0BB0A30323E8301FAB249EF84E8DFA4DCC750BEC8F16C585D98
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................#.......r...R..s..L.a.z...A.r.a.m...A.v.a.r...E.l.a.m...E.s.t.i...F.u.l.a...K.a.d.o...K.r.e.e...A.n.g.k.a...D.a.n.s.k...E.r.y.z.a...G.o.t.i.k...H.i.t.i.t...K.a.r.i.a...K.a.r.i.b...K.o.s.r.e...K.u.r.d.i...K.u.r.u.k...L.y.c.i.a...L.y.d.i.a...N.i.u.e.a...N.u.s.h.u...R.u.n.i.k...S.k.a.u.s...S.u.o.m.i...V.o.t.i.a...W.a.r.a.i...A.v.e.s.t.a...S.u.r.i.a.h...A.b.k.h.a.z...A.d.y.g.e.i...B.I.S.K.A.Y...C.h.e.s.k.a...C.h.u.u.k.e...F.r.i.u.l.i...G.o.t.h.i.c...I.t.a.l.i.a...J.e.r.m.a.n...K.a.l.m.u.k...K.a.n.t.o.n...K.h.o.t.a.n...K.i.r.g.i.z...K.o.k.t.a.w...M.a.n.d.a.e...M.i.k.m.a.k...P.o.l.s.k.i...R.o.t.u.m.a...S.h.a.v.i.a...S.i.p.r.u.s...S.l.o.v.e.n...U.g.a.r.i.t...Y.a.p.o.i.s...B.a.v.a.r.i.a...B.e.l.a.n.d.a...F.u.n.i.s.i.a...G.a.l.i.s.i.a...G.i.l.b.e.r.t...I.n.g.g.r.i.s...K.a.b.a.r.d.i...K.a.r.e.l.i.a...K.o.m.o.r.i.a...K.o.r.n.i.s.h...K.o.r.s.i.k.a...L.e.z.g.h.i.a...L.i.g.u.r.i.a...L.i.t.u.a.v.i...M.i.r.a.n.d.a...M.o.n.o.t.o.n...N.g.a.m.b.a.i...O.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ig.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2308
                                                                                                                            Entropy (8bit):4.540655170423697
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:K2coGYZDwtcHbjgIRzolvUDAVrRZZegsadIvY3thJJ:yeDwtcoIR0l2AVr/hsayvY3b
                                                                                                                            MD5:1DF44368DAF33829E4D77A7575EF4C44
                                                                                                                            SHA1:13D5F88B90ACEB21C86426D260D8546E5A0B9A9E
                                                                                                                            SHA-256:7E419E443A89C425435414A79A0C935E46A1EBC3A919F6CA7E4783ED4952CA65
                                                                                                                            SHA-512:6002430A6165099A6193061B39D03D074122869261151E7FF7CC67B0D1886069EA7843BD5BC081823FED6819C7C60C4D47774F29616E8F9555639E1FA129F529
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................,.. ........9...9...<.......'...R..s..T.a.....A.w...s.a...D.....c.h...C.h.e.e.k.....M.a.g...y.a...M.a.l.e.y.i...M...a.n.m.a...P.e.s.h.a.n...T.a.m...l.....G.i.r.i.i.k.....R.u.m.e.n.i.a...R...w.a.n.d.a...A.m.a.r.i.i.k.....A.r.a.b.i.i.k.....P.o.l.i.i.s.h.i...T...k.i.i.s.h.i...U.k.u.r.e.e.n.....B.e.l.a.r.u.u.s.u...B...l...g.a.r...a...I.n.d.o.n.i.s.i.a...H.a.n. .I.z.u.g.b.e...A.s...s... .I.g.b.o...A.s...s...:. .{.0.}...E.d.e.g.h... .e.d.e...H.a.n. .d.i. .m.f.e...M.a.n.d.a.r.....n.....N.k.e. .d... .m.f.e...S...w.i.d.i.i.s.h.i...A.s...s... .B.e.k.e.e...A.s...s... .J.a.m.a.n...K.e.m.e.,. .E.t.i.t.i...U.s.o.r.o. .N.h.a.z.i...V.i.y.e.t...n.a.a.m.....A.s...s... .a.m.a.g.h.....B.e.k.e.e. .n.d... .U.K...B.e.k.e.e. .n.d... .U.S...A.s...s... .F...r.e.n.c.h...A.s...s... .I.t.a.l.i.a.n...A.s...s... .R.u.s.s.i.a.n...A.s...s... .S.p.a.n.i.s.h...M.p.a.g.h.a.r.a.:. .{.0.}...A.s...s... .J.a.p.a.n.e.s.e...K.a.l.e.n.d.a. .G.r.e.g.o.r.y...A.s...s... .P.o.r.t.u.g.u.e.s.e...B.e.k.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ii.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):516
                                                                                                                            Entropy (8bit):5.328377616567796
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:Svcmlbgsls1BvQGipUFdTEsPnF4H6cRbMH+ZeUFliuRnYfjnuMeTIkiS2YmAuskB:szsLFHwsdcpM+FCfdkB/WgwEm2TT04s
                                                                                                                            MD5:EAA431A649076E666AAFE58DD444BA70
                                                                                                                            SHA1:357FEA0085F36BBAED83487A2B1C15F62FD9E4B4
                                                                                                                            SHA-256:E85CFA46931912CD60AFEC25CA10631F2522F86BCC7970304B3A1C72AA7D160F
                                                                                                                            SHA-512:56982644B9AD874B613612D2DDDF9CC592CBDA75C26F3C1CA6DD6B50FDE0EB8BCF675A65BE7F6976D91044C3F887C52316D88F543D55F2D4613FE69EE3311305
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................q.. ........y...y...........o...R..s....Y......Y..... .Y......Y....*.Y...q..Y...q...F. .....{..M..... .q.........q.....m. .x.Y...t.....Y...../.O..Y.......(.q........O..Y...I... .G.....s.&..M.V... ._.M.(.x.Y......L.2.q.....I..... .q......./.L.2.q.........&....q......7.:. .{.0.}...G.Y.:. .{.0.}....q.:. .{.0.}.....7.X.o.....................................................e.......B........../././......./..................)/1/!/.........P........V......P...Po.. ...`...P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\jv.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5192
                                                                                                                            Entropy (8bit):5.071203043587727
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:brZQAv2QboMPRPInxmWip65+Evj31f4j0hblubmWG4yW46g9cwe0XGVCz68I4FGH:brZQAFJPoxZyzEL1t4bZfb0XGVCOSsKs
                                                                                                                            MD5:21972FF0C8DB621CDBEEA4D01034D910
                                                                                                                            SHA1:451F76FC86B9B5C94A7D0E2314076F7766EE6CFD
                                                                                                                            SHA-256:FE87D00FF0B9326542C0ED7B58F5B76E16CB09B0CDBC1E0D934DC4CD1E007B21
                                                                                                                            SHA-512:AA1DE7C960F75B448BED68736554F8DBF00C2F4816A1D04F31694768FF13F9AA764886CEAFC844FF1FE93A50106EACA13DD62667DCFFFE3A378301FD956D5674
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .j....................j.....R..s..a.f...b.s...I.q.b.o...J.a.w.a...A.n.g.k.a...C.e.s.k.a...D.a.n.s.k...I.n.d.i.a...R.o.m.a.n...S.u.o.m.i...F.l.e.m.i.s...G.a.u.l.i.a...I.t.a.l.i.a...J...r.m.a.n...K.a.n.t.o.n...K.a.t.a.l.a...K.i.r.g.i.s...K.u.r.d.i.s...P.u.n.j.a.b...S.i.m.b.o.l...C.o.l.o.n.i.a...G.a.l.i.s.i.a...I.n.g.g.r.i.s...K.o.r.s.i.k.a...K.r.o.a.s.i.a...O.s.s.e.t.i.a...P.r.a.n.c.i.s...R.u.m.a.n.i.a...S.p.a.n.y.o.l...U.k.r.a.i.n.a...W.a.l.a.n.d.a...M.o.n.g.o.l.i.a...E.t.h.i.o.p.i.k...I.r.l.a.n.d.i.a...I.s.l.a.n.d.i.a...K.e.r.n.o.w.e.k...P.o.l.a.n.d.i.a...S.l.o.w.a.k.i.a...T.y.o.n.g.h.w.a...B.a.s.a.:. .{.0.}...T.a.n.g.g.a.l.a.n...D.i.g.i.t. .O.d.i.a...{.0.}. .t.u.n.y.u.k...D.a.e.r.a.h.:. .{.0.}...D.i.g.i.t. .L.a.t.i.n...H.a.n. .P.r.a.s.a.j.a...N.d.e.b.e.l.e. .L.o.r...O.r.a. .K.e.t.u.l.i.s...{.0.}. .. .k.a.b.e.h...I.n.g.g.r.i.s. .(.A.S.)...J.e.r.m.a.n. .S.w.i.s.s...K.u.r.d.i. .T.e.n.g.a.h...{.0.}. .. .l.i.y.a.n.e...D.i.g.i.t. .B.e.n.g.a.l.i...D.i.g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\km.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):11996
                                                                                                                            Entropy (8bit):4.971862421082815
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:XayP0n6ghoVG8jcydLy8crskltPI7As63MBRIbMSGC5vdaX54RI+t6LXI8Pfhjh:Kyq6hR7SIMssMOGwaSy+t6LXJP9h
                                                                                                                            MD5:EA8690FD132C4B09D1CC060E326D34EC
                                                                                                                            SHA1:1305877BA04C2D96887F8D912853E0BE160428CF
                                                                                                                            SHA-256:797505C29E28D17795EFA66472B90382AE264D208279384FD0DCECAF1E324ED0
                                                                                                                            SHA-512:3062593518B6DEEE7B4C88A5E1DBEC28C5DEBC514974A62779CAA2FFE3A3C20DBFE8B28A25FE08C77571EA1B9DA1DE9965D92013C3D1FE508401D9D3B1540695
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................R..s....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ky.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12964
                                                                                                                            Entropy (8bit):4.66170967139447
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:kDb5cs8FxvLu/XLX/veKquxPG/DoYrgG4L65l1AD+Dyprret:kDb5clLTu/XLX/veKq2PG/MY8fYVDyF4
                                                                                                                            MD5:C4F1AB6E41958B795BA30EF55700B597
                                                                                                                            SHA1:10EC8126AC5C667BDE13E24653AA48CE810161C5
                                                                                                                            SHA-256:4E44267DE9D168463850C2C76631AAD56DDE3091A1A71952D05BAE71B2C03182
                                                                                                                            SHA-512:63F5A0F563C3C139274EE63BA3651B925C591A6BBB80D42137AD9DFA1B5242FD53D74E61E07031C87E1D069D8430C887F85E8D6C6A6E3642544B90E006B4CBB6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................v...R..s....0.>...".0.9.....@.0.1.....@.5.:.....<.5.@...".5.;.C...%.0.=.1.....@.<.O.=.....@.5.9.;.....6.0.<.>.....0.;.?.K.....0.?.0.=.....2.@.8.B.....>.@.5.9.....0.B.K.=.....@.8.9.0...".0.0.=.0...".0.<.8.;...".8.1.5.B...-.D.8.>.?...0.A.C.G.0...4.0.B.G.0...4.6.C.G.0...8.4.>.G.>...;.0.>.G.>...;.C.>.G.>...=.:.>.G.>...@.C.0.G.0...B.O.?.G.0...B...?.:.....D.8.=.G.5...D.>.=.G.>...H.0.=.G.0...M.1.5.G.5...0.G.5.E.G.5...A.>.3.0.G.0.....5.=.3.0.;.....@.C.7.8.=.....8.@.8.;.;.....>.=.3.>.;...!.0.=.4.0.@...%.0.=.3.C.;...0.3.5.<.G.5...0.7.5.@.G.5...0.9.=.C.G.0...0.:.0.=.G.0...0.@.0.1.G.0...0.D.0.@.G.0...1.0.;.8.G.5...1.0.A.:.G.0...1.5.=.0.G.0...1.8.=.8.G.5...1.;.8.=.G.5...1.>.4.>.G.>...2.0.9.8.G.5...3.8.8.7.G.5...3.@.5.:.G.5...3.C.A.8.G.5...7.0.7.0.G.0...7.C.;.C.G.0...7.C.=.8.G.5...8.1.0.=.G.0...8.3.1.>.G.>...8.4.8.H.G.5...:.0.:.>.G.>...:.8.G.5.G.5...:.<.5.@.G.5...:.>.<.8.G.5...:.>.@.>.G.>...:.>.A.0.G.0...:.@.8.:.G.5...;.>.7.8.G.5...<.0.@.8.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ln.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):980
                                                                                                                            Entropy (8bit):4.143220693741953
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:WWkTI9m+Kt3Dh5/9x0dL+M1/G0JvRLu0F:72DP/9iRrBhF
                                                                                                                            MD5:819C9824663BDEE2475C0F42BBE6B3BB
                                                                                                                            SHA1:A6EDE12F3D8DF668C397F1FB03A13CD212B7D73E
                                                                                                                            SHA-256:CA33D0088BFC2ED68EA0751E9B0DA486B3FCB6509C65B4011E037074A3421AB8
                                                                                                                            SHA-512:32ACD8164EE3519D92769730417C926D60898E25F4857DF12007F72A2EDF7E1FAEE150225B3A62EA5F77D2F886711D20C478E2CACEF2390D8A3593B460565CFF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..p.............-......p....R..s..l.i.r.i.s.....l.i.t.a.y.e...l.i.u.r.d.u...l.i.z.a.p.T...l.i.z.a.v.a...l.i.a.l.a.b.o...l.i.a.l.e.m.....l.i.h.i.n.d.i...l.i.k.r.[.n.i...l.i.n.g...l.a...l.i.s.i.n.w.a...l.i.b.i.l.i.m.....l.i.f.a.l.a.m.....l.i.g.e.l.e.k.i...l.i.k.o.r.e.y.a...l.i.m.a.l.e.z.i...l.i.n.e.p.a.l.[...l.i.o.n.g.i.l.i...l.i.p.o.l.o.n.[...l.i.s.o.m.a.l.i...l.i.s.u.w.e.d.[...l.i.t.a.m.u.l.i...l.i.t.i.l.i.k.i...l.i.t.s.h.e.k.[...l.i.a.m.a.r.i.k.i...l.i.b.e.n.g.a.l.i...l.i.n.d.o.n.e.z.i...l.i.s.i.p.a.n.y.e...l.i.t.a.l.i.a.n.o...l.i.b.i.l.i.g.a.l.i...l.i.f.a.l.a.n.s.[.....l.i.k.a.m.b.o.d.z.a...l.i.n.g.[.l.[...s.a...l.i.p.e.l...s.a.n.[...l.i.p.e.n.d.z.a.b.i...l.i.b.y.e.l.o.r.i.s.....l.i.v.i.y.e.t.i.n...m.i...l.i.p.u.l.u.t.u.g.[...s.i...-.@...[.......*.7.B.X.o.....@.....'.........D.Y.O.......0.[.........A.M.............H.F........q.q(r.q.q.q.qQq.r.q.r.q...quq.q...q.q.q.qZq/qcq?qlqHq.r~qAr.$.p.p.q.q.q.p.q'q.p4r."7q'.......V...d..P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\lrc.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5552
                                                                                                                            Entropy (8bit):4.785841425159864
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:/z2dO96bXC7RiGI1LC7kk8/746Rvw5FmXRxGEPjHwoWqA:/q49ceiBDrRmmiWHxPA
                                                                                                                            MD5:3E47E97864163178104D23AB384B391B
                                                                                                                            SHA1:CF2F6BD65DAAF9CB748654C2A690DE87A8D2E77F
                                                                                                                            SHA-256:C60675581D75AF114E0D504D492E3A6DBBDC653B7102DC65B65A889259DE16B3
                                                                                                                            SHA-512:FFE91DF77878764C0AE4DE44AF2A7DD808732AA16B1A52EC5C4DC5AE49AB95A337CB20237D069F6B7206FA014E428E12DC59B2177D1EA62BBA618099CA091A92
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................W.. ........d...d...........R...R..s..&...&...D.'.H...D.H.Y.....'.....".3.H.Y...".B.&.E...&.E.(.H...(.&.F.'...(...E.'...*.&.3.H...*.'.F.'...1.&...'...3.&.F.'...A...,.....D.'.&.H...E.&.1.H...............&.F.......'.F.....&.H.1...'...*.'.E...D.....&.E.&.1...9.&.(.1.......H.1.,.....".0.#.1.....&.....(.H...(.'.A...'...*.H.1.........H.Y.3.'...3.&.1.(.....3.&.F./.....3.H.Y...'...B.#.2.'.B...E.&.*.'.[...E.'.F...3...F.&...H.Y.....H.'.4.......&.D.2.......H.D.H.A.....'.F.'./.....H.Y.3.....#.1.E.#.F.....*.#.(.#.*.....*.&.D.&...H...E.H.:.H.D.....".D.(.'.F.....".D.E.'.F.....#.E...#.1.....&.H.1./.H.Y...(.&.1.&...D...(.H.Y.~.H.Y.../.H.Y.'.D.'...3.'.F...H.Y...3.H.Y.&./.....D.H.Y.&...'...E.#.,.'.1.....E.#.1.'.*.....E.'.&.H.1.....E.'...'.E.&...F.&.~.'.D.....F...H.Y.&.1...~.#.4.*.H.Y.....&...&.F.......'.(...D.&.....H.1.F...4.....H...H.Y.'...........H.Y.....'.D...3.......'.&.H.3.'.....'...'.........'.....*.....(.#.F...'.D.....,.'.~.H.Y.F.....E.'.D.'...'.E.....H.1.&. .......

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\lv.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):19264
                                                                                                                            Entropy (8bit):4.522583117528537
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:Ai61FYdfSu9cuXd3uh+m/ESiS6SKS8SPlS8SKSKqS6SRSS1SsSoAVYSbaSdvSXNb:AiwWd3e+oE1N1S8uDl1qp0SqLSY9+6/z
                                                                                                                            MD5:0EE42B9144D454937CAED63DB74270E8
                                                                                                                            SHA1:2B5F4DA980B4CCF5F6189AF6DD3CD0BD2B0E2D98
                                                                                                                            SHA-256:B92E14DF347A636B81350A7D2E3EA99D7F4CD15F6BD6D87E57CFF15F21149946
                                                                                                                            SHA-512:DEFDA5831550A8F3E26449100AD3DBCC9E4F212407E39747FF2ED1C9CE396CC702C2733BB8361F470FE89B73C9540CE10C63DB550D320B448F2CC4EC773712C9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................R..s..j.g.o...k.r.+...m.g.o...t.v.+...g.o.t.u...t.a.j.u...b.a.s.u...b.i.n.u...b.u.g.u...d.a.z.u...d...F.u...f.o.n.u...f.u.l.u...f...r.u...g...z.u...h.a.F.u...h.e.t.u...h.u.p.u...k.a.d.u...k.o.m.u...k.o.r.u...k...v.i...l.o.z.u...m.a.b.u...m.a.f.u...m.o.s.u...p.o.<.u...p...l.i...s.o.g.u...s.o.m.u...t.i.v.u...t...n.a...v.a.j.u...v.o.t.u.....e.h.u.....k.k.u...F.o.r.u...a.a.n.u...a.o.n.u...k.o.p.t.u...o.r.i.j.u...z.u.n.d.u...a.d.i.g.u...a.f...r.u...a.k.a.n.u...a.v...r.u...a...o.l.u...b.a.s.k.u...b.e.d.~.u...b.e.m.b.u...c.o.n.g.u...c.v.a.n.u...d.a.r.g.u...d.i.n.k.u...d.i.k.l.u...d.o.g.r.u...d.u.a.l.u...e.f.i.k.u...e.r.z.j.u...f.a.n.g.u...f.a.n.t.u...f.l...m.u...g.a.n.d.u...g.b.a.j.u...h.a.i.d.u...h.a.u.s.u...i.b.a.n.u...i.l.o.k.u...k.a.d.~.i...k.a.m.b.u...k.e...v.u...k.h.a.s.u...k.h.o.s.u...k.o.n.g.u...k.r.+.k.u...l.a.m.b.u...l.a.n.d.u...l.u.h.j.u...l.u.n.d.u...m.a.i.j.u...m.a.o.r.u...m.e.n.d.u...m.j.e.n.u...m.o.k.a.u...n.j.a.s.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\mo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8415629909004982
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMns06E7lE/0a:Svat6g+X
                                                                                                                            MD5:F454E2C0F3E2C211142EBE3A6CDB031D
                                                                                                                            SHA1:24C65C7882928C4686CC141741A0E6BB65E4FEAA
                                                                                                                            SHA-256:14E2F94045FCB194E4BB2CBC39935CBE84F3479754393C9A1C029F2E702EFEF7
                                                                                                                            SHA-512:92285CEF0934B29484FEE75E76707334E208EB0602F00ACBA2378E4220F63A1AE4FC48EC276218896D7689CE6638892FA7B76082FDEE4A790D2E54A0F5B9F0DE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ms.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10988
                                                                                                                            Entropy (8bit):4.974565944055817
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:dsJanyEyEVTbHFPStZVWhnApH5Q4rBstRBXLeV/djM7ICFn9vKPdes08/Q07m6dD:6JaTdHFPStZV2nSH5QAstnqVadKVPHfz
                                                                                                                            MD5:1319DCF9C1470CF1CA20E35BBBB3445F
                                                                                                                            SHA1:6715D87BE00F6C06C137C951DDA333078AFBFFD4
                                                                                                                            SHA-256:3949D91AAEE83B53522EC9B914B35C4ACCB1AB7598206F69EE2D4C3248E35A63
                                                                                                                            SHA-512:3EFD4CA2584AD6C0516F5B00D823BADBE7824F4C79A33E9C0E57217704422C3C90D0F05A5EE904EAAB6D8721F39B542DF391FDD8094DFC991A5840986E487F47
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................v...R..s..N.i.u...I.t.a.l.i...L.a.z.i.m...W.a.l.e.s...J.e.r.m.a.n...K.i.k.u.y.a...O.s.s.e.t.e...P.o.l.a.n.d...S.i.c.i.l.i...S.w.e.d.e.n...B.e.l.a.n.d.a...B.e.l.a.r.u.s...C.h.u.k.e.s.e...C.i.n.a. .W.u...C.o.m.o.r.i.a...C.o.r.s.i.c.a...D.e.n.m.a.r.k...F.i.n.l.a.n.d...G.u.j.e.r.a.t...H.u.n.g.a.r.y...I.c.e.l.a.n.d...U.k.r.a.i.n.e...B.e.n.g.g.a.l.a...2...1...4.9...2...A.b.k.h.a.z.i.a...C.i.n.a. .G.a.n...F.i.l.i.p.i.n.a...I.n.g.g.e.r.i.s...K.a.b.a.r.d.i.a...K.a.l.e.n.d.a.r...K.a.n.t.o.n.i.s...K.i.r.i.b.a.t.i...K.o.m.p.u.t.e.r...M.o.l.d.a.v.i.a...P.e.r.a.n.c.i.s...S.e.p.a.n.y.o.l...B.e.r.n.o.m.b.o.r...C.a.t.a.l.o.n.i.a...D.i.g.i.t. .M.r.o...D.i.g.i.t. .V.a.i...O.c.c.i.t.a.n.i.a...Z.o.n. .W.a.k.t.u...P.e.r.s.o.-.A.r.a.b...D.i.g.i.t. .B.a.l.i...D.i.g.i.t. .J.a.w.a...C.i.n.a. .H.a.k.k.a...C.i.n.a. .X.i.a.n.g...D.i.g.i.t. .A.h.o.m...D.i.g.i.t. .A.s.a.l...D.i.g.i.t. .M.o.d.i...D.i.g.i.t. .N.. K.o...D.i.g.i.t. .T.h.a.i...I.s.i.h. .A.k.s.e.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\nb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15012
                                                                                                                            Entropy (8bit):5.042198577749172
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:jq5oytq/nYt1aaAiUIXkN6EW6jDqT8RC78xrz6Itu1pvNrl+TYlTos/HseUmUsVI:m5ompt1aaACJlARzwI+Xp/MeUV0Qx
                                                                                                                            MD5:53FC80551FB174F8E1E25B69EE7A5F8A
                                                                                                                            SHA1:FCB0CCBBC9DDF0AC374673102AB353D88C909BF4
                                                                                                                            SHA-256:800DFDB2D2ABC9FC131D74C30AC9A5536D86F8656536A1D7A9308EA87484E36A
                                                                                                                            SHA-512:01E6DB1D21A925A24B860F5705BB47D98E13B21C2FFC8134BCD0A6F051B213CAB02531A88FEE136B010D6659A50354193AEFD7F0C9E27567A46F46E64FB6C803
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .N..............[.....N.d...R..s..j.y.s.k...r.i.f.f...a.k.o.s.e...e.r.z.i.a...k.a.p.i.z...f.e.l.l.e.s...f.r.a.s.e.r...g.i.l.e.k.i...k.a.r.i.s.k...k.i.e.m.b.u...k...l.n.s.k...l.a.z.i.s.k...l.i.v.i.s.k...m.i.n.n.a.n...m.o.k.s.j.a...t.a.l.y.s.j...z.e.e.u.w.s...l.a.o.t.i.s.k...b.a.i.r.i.s.k...f...r...y.s.k...g.a.s.s.i.s.k...i.n.g.r.i.s.k...j.i.d.d.i.s.k...k.a.b.y.l.s.k...k.o.r.n.i.s.k...l.a.d.i.n.s.k...l.a.t.v.i.s.k...l.e.s.g.i.s.k...m.a.n.d.s.j.u...n.o.g.a.i.s.k...p.o.n.t.i.s.k...r.u.m.e.n.s.k...r.u.s.i.n.s.k...s.e.s.e.l.w.a...s.o.g.d.i.s.k...t.u.v.a.l.s.k...t.u.v.i.n.s.k...v.a.i.d.i.k.a...v.e.p.s.i.s.k...z.a.z.a.i.s.k...a.d.y.g.e.i.s.k...a.r.a.g.o.n.s.k...a.r.o.m.a.n.s.k...b.e.n.g.a.l.s.k...b.i.s.c.a.y.a.n...c.e.b.u.a.n.s.k...e.l.b.a.s.i.s.k...f.o.n.x.s.a.m.p...f.u.l.f.u.l.d.e...g.a.l.i.s.i.s.k...h.a.w.a.i.i.s.k...k.a.i.t.h.i.s.k...k.a.r.i.b.i.s.k...k.a.s.j.m.i.r.i...k.o.c.i.e.w.i.e...k.o.m.o.r.i.s.k...k.u.m.y.k.i.s.k...l.i.g.u.r.i.s.k...m.a.l.a.y.i.s.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\nmg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1304
                                                                                                                            Entropy (8bit):4.25693545904243
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:jDfYElrecyT0x1m9qMVqnVWdo8ChtHhnzROEp0D19SiBQ1m8Jt4aE3u:jXCcyASkMVcVceh9xlOP9BR3e
                                                                                                                            MD5:D29DE5920AE0135DB10D4FFDA770711E
                                                                                                                            SHA1:01673E54DA28C57B05FAF767030022B841B86F9D
                                                                                                                            SHA-256:5BC5DC42CE6FDA2F6DC808E24F15B2F87021ED5FBD226CA9C346A3B6EC787EC8
                                                                                                                            SHA-512:68DEC56D7D5A6EFCC60EB45C172B0255BA53767831EA409D02A9162D655A027C0246F78A5B4C0B9211E8C1032707F12017F440BC248A3B7DA984227A3AF2E79E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................:.. ..Q.....>...>...,......Q:...R..s..F.a.l.a...P.a.K.....J...m.a.n...Y.o.r...b.....N.g.[...l.[...n...K.i.[.l. .a.k.a.n...K.i.[.l. .i.k.b.o...K.i.[.l. .k.o.r.....K.i.[.l. ...r.d.u...K.i.[.l. .t.a.m.u.l...K.i.[.l. .a.m.a.r.i.a...K.i.[.l. .b... .m.[.r...K.i.[.l. .i.t.a.l.i.a...K.i.[.l. .m...w...s.....K.i.[.l. .p.T.l.T.K.e...K.i.[.l. .p.[.r.s.i.a...K.i.[.l. .r.u.s.s.i.a...K.i.[.l. .r.w.a.n.d.....K.i.[.l. .b... .g.r.[.k...K.i.[.l. .b... .t.u.r.k...K.i.[.l. .b.. ..r.a.b.e...K.i.[.l. .s.o.m.a.l.i.....K.i.[.l. .v.i.[.t.n.a.m...K.i.[.l. .M.a.l.[...s.i.....K.i.[.l. .b.e.n.g.a.l.i.a...K.i.[.l. .b.i.r.m.a.n.i.a...K.i.[.l. .b.u.l.g.a.r.i.a...K.i.[.l. .b... .t.c.h.[.k...K.i.[.l. .b.. i.n.d.i.e.n...K.i.[.l. .p.[.n.d.j.a.b.i...K.i.[.l. .b... .r.u.m.[...n...K.i.[.l. .i.n.d.o.n.e.s.i.e...K.i.[.l. .b.e.l.a.r.u.s.s.i.e...K.i.[.l. .b... .c.h.i.n.o.i.s...K.i.[.l. .b... .j.a.p.o.n.[.....K.i.[.l. .b... .j.a.v.a.n.[.....K.i.[.l. .b... .s.u.e.d.o.i.s...K.i.[.l. .b...l.l.a.n.d.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\no_NO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.6921723843305845
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlKelBjlgljl/FiFahn:SBtkJTl4t
                                                                                                                            MD5:2025BF7EE3171A6EE32EE4BAB511826A
                                                                                                                            SHA1:1D2CE8C50DAC406DA46723D496F7178E71E96EF9
                                                                                                                            SHA-256:41BD6D9FA31CF3D56880C336617B9B5CFDD72762803B2355470DEE494B8CF210
                                                                                                                            SHA-512:A981654800DF71FCFC479CE3166546ACE474D25827ECCE05B0A530C1D6EC95ED9628758F23E318DC342ED40B4E5014FFAF89C3A5A953AA051C4B62E62B2105C4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s..n.b._.N.O.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\or.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17836
                                                                                                                            Entropy (8bit):4.707405624637349
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:e8RqNVELt0jQ08TFSajm2Hiziw15Mkjv/HFXaD:5Rq3ELtYQzTwax7Kv/lXaD
                                                                                                                            MD5:59D301FCFD92CA17172D10CFF13C19D3
                                                                                                                            SHA1:95457A6A76C8B596A25D8CEC4D6D24DA6F488089
                                                                                                                            SHA-256:6139FBAABB48B72D0EF0F2E78C962BB7BFAF630BB0EF76D67A6286D171020473
                                                                                                                            SHA-512:477EF4739C36A8A2E65CDC89791B273139C61C466DF581B05DAE5BFF792845B05E3F2919553F570C43B7880E2EC08723EDC79F868DF87CCA2757DBA90B8606B6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................S.. ........c...c...........8...R..s..%.>.....2.>.......8.A.....!.K.....q.G.......M.......A...!...M...+.(.M...-.>.....2.A.....8.9.K..._.>.....q.>...........>.......(.M.......(.A.......G.......0.q.........,.K.....(...K.....>...K.....>.!.K.....>.q.?.....?...G.....H.%.?.....K...?.....K.0.K.....M.0.@.....>.8.@.....K.8.>.....>._.K.....A.8.?.....?...>.....G...M.....>...>.....>...K.....A.(.@.....A.2.A...$.@.-.M...$.G.8.>...$.M.q.?...%.>.(.>...(.>...>...(.A...0...*.>.2.?...+.?...?...,.>.8.>...,.?.(.?...,.G...>...,.G.(.>...,.K.!.K.....>.0.@.....>.2._.....?...K.....G...>.....G.0.A.....K.8.?...0.K...M...2.>.(.>...2.K...?...6.>.(.M...6.A.6.A...6.K.(.>...8.>...>...8.G.(.>...8.K...>...9.>.(.M...9.?.,.C...9.A.*.>...9.L.8.>...q.>.0.H...q.>.8.K.....!.<.?.....8.?...9.3.....+.>.0.M.......K.2.?.......G.0.?.....q.>.'.?.....,.>.(.M.......K...?.....0.?.8.M.....2.K...K.....+.?...M.......M.5.A.......>...>.......?.q.>.....0.K...K.......M...K.......?.(.M.....(.A.0.@.....(.M.(.!...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\pa_Arab.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):132
                                                                                                                            Entropy (8bit):4.096745944387419
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlW7s+mlplplmV/ExIMjti5Z/lP3Alsldi9YF:SvGYpCV/LMjtavldi9o
                                                                                                                            MD5:CE3C1BCB4E03B1A75476B8D7396C9515
                                                                                                                            SHA1:5ABBCFE32F3AF0BD53FEB8779D7B959518E119AF
                                                                                                                            SHA-256:6D51FE711A2EDCE669FD776778B85474085A0F4068ED61802646B6E428B9C9CC
                                                                                                                            SHA-512:A54504D4B3F7EA491BDF8A02833AE1822B729EB7E0B0F7F41656411D773957E2F1326605D45D5A09007A66113CE4D735B34AB5619EBC82A15FFC730C7506ADA0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .{\...................{\....R..s....O.1.E.O...........[.....e...z\|\..j.....V......`...P...P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\pa_Guru_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.411243631352237
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/E9:SBtkJ1li6gml/o
                                                                                                                            MD5:A0E7F0023EFE9D9DA802A0C5A941F8CE
                                                                                                                            SHA1:E4522C97B99704605469449C21AEEF8E03A0AD3E
                                                                                                                            SHA-256:756032017E2D9DEB9EC1508DAFB605009EADF6D859FF309BBCD6E49BB2D8D9F2
                                                                                                                            SHA-512:2B06564FB675F51D96E9945A303D9AADAEABB8173222AC644AC3415D5AC1AEC958D70F651A5C85561CDD79E0F4B713D43117332A8536A251F4FB48800076AB01
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....s...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\pa_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.905547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/EZMx/i3:SBtkJYlU8g8l/zZu
                                                                                                                            MD5:FDA7107459FC09A594A5F3920C0F7DBA
                                                                                                                            SHA1:9DDCB2E2ECE873608AA43CABA4F145F5568A792D
                                                                                                                            SHA-256:45D37274BE14BD0B14FA4C0A3BAE888FE0F955E02316A38CD57991AEC296AF00
                                                                                                                            SHA-512:49ABD03EA512EE4DFAA0A556F94C594A67F94CBD4E3CC79EEB5A742FBBDE6CA2159CBE62765397D48C74CAF1611C7E960C9AEDD83BFB1454B4825775B20C2331
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s..p.a._.G.u.r.u._.I.N...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\pool.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):121484
                                                                                                                            Entropy (8bit):4.34897404391638
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:Q5gJ9gqjUu5UyWQae6I5mJUfJU946m3Zb8okMaEc725UMuyeQ2jXc+fxQxc7y0hL:2gJiuaJkJH2L
                                                                                                                            MD5:774C36C7C26169F949286336BC52C2AA
                                                                                                                            SHA1:0C5FDB84228C828912C8EF0722C24F524BC557E5
                                                                                                                            SHA-256:76F7C78A49AC38E8EF210E44800FD25C2D0AB3063E62F70799A0A8DC50B8CE1C
                                                                                                                            SHA-512:4FD4938E7096D0ECA2B8925575D99750F659BE926F4A49776A209FA92DAE2D416BA99C70D3BAAD97CD2CF1285454D0A038F2C43CE06E8C8E124CDF66118CA18C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .........v...v...........v..R..sKeys.calendar.cf.colAlternate.colBackwards.colCaseFirst.colCaseLevel.colNormalization.colNumeric.colStrength.collation.currency.hc.lb.numbers.timezone.Languages.ach.ada.ady.agq.anp.ar_001.arn.arp.asa.awa.ban.bas.be.bem.bez.bg.bgn.bho.bin.bm.bn.brx.bs.bug.byn.ca.ceb.cgg.chk.chm.chr.chy.ckb.cop.crs.cs.cu.cv.dak.dav.de_CH.dgr.dje.dsb.dua.dv.dyo.dz.dzg.ebu.efi.egy.eka.en_GB.en_US.eu.ewo.fa.ff.fil.fj.fon.fr.fur.fy.gaa.gag.gan.gez.gil.gor.got.grc.gsw.gu.guz.gv.gwi.hak.he.hil.hit.hmn.hsb.hsn.ht.hup.hz.iba.ibb.ie.ilo.io.ja.jbo.jgo.jmc.jv.kab.kac.kaj.kam.kbd.kcg.kde.kea.kfo.kg.kha.khq.ki.kkj.kln.kmb.kn.ko.koi.kok.kpe.krc.krl.kru.ksb.ksf.ksh.ku.kum.kv.kw.ky.lad.lez.lkt.loz.lrc.lua.lun.luo.lus.luy.mad.mag.mai.mas.mdf.men.mer.mfe.mgh.mgo.min.mk.mni.moh.mos.mt.mua.mul.mus.mwl.my.myv.mzn.nan.nap.naq.nds_NL.new.nia.niu.nl.nl_BE.nmg.nn.nnh.nog.nqo.nso.nus.nv.nyn.pa.pag.pam.pap.pau.pcm.phn.prg.qu.quc.rap.rar.rof.root.rup.rwk.sad.sah.sa

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ps.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9100
                                                                                                                            Entropy (8bit):4.871376882845236
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:QP7fUhtjoHc0tt1vq8jtuyGpmyUBGk6x8iI4/Yu5E:AUYV5jtIeB56+sDE
                                                                                                                            MD5:EE41A7412A182CB15B38C497674AED2D
                                                                                                                            SHA1:91DCF8F0CBF98DB8B3A7148E8D963670FE6997B4
                                                                                                                            SHA-256:CA12C3EC7275BFE5CFCF257B16D832BEA1661FAA549F31F7FC0A11764B537F1D
                                                                                                                            SHA-512:3BF0064188D4EBB9DA226FE71E0C7C3B28C2F4030AA76D21DCF057B189F644C667DB2A8E63F736BA6E202F4187CC18624C6571D4755B769FC2BCCC14FCF48B3C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...........................R..s..G.F.....E.1...'.(.F...'.A.....'.J.H...'...H...,.,.H...1.H.|...3...'...3.G.H...A.'.F...D.'.H...F...H...H.'.................2...*.(.*.J...'.0.1.J...'.A.1.J...'.F...4...'.H...'...'...,.....'...(.H...'...E.H...(.A...'...(...(.'...*.'...~...*.*.H.E...*.1...J...*...3.H...*.....1...-.(.4.J.....'.3.....2.H.F.J...3.H...'...3...F.'...4.J.F.J...9.(.1.J...B.'.2.B...D.F./.'...D.F.......D...|.H...E.'.3.J...E.E...B...E.J.|.'...E...G.J...F.H.......F...(.'...H.'.1.....H.D.H.A...J./.J.4...~...*.H.......E.'.......F.J.........J.....'...H.....1./.J.....H.1.......H.E.........D.J.....H.3.J.....H.~.'...*.'.E...D...'./.J.:.J...'.1.2.J.'...'.1.E.F.J...'.3.'.E.J...'.3.H.J.J...'.:...E.J...'.D.H...H...'.H.'./.J...'.H.'.1.J...'.H...J.'...'...J.F.J...'...'.F.J...(.'.3...J...(.'.D.F.....(.'.E.1.G...(.1...D.J...(.D.H...J...(.F...D.G...(.H.3.F.J...*.'.,...J...*.G.'.F.'...*...E.F.J.../.'...1.(.../.1...H.'.../.H.'.D.'...1.H.F.......3.'.F...H...3.F./.G.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\pt_AO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1626531665973814
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM8E/flMl3ViGj1:Sv1jtBj1
                                                                                                                            MD5:AAE879C1E1523CD47B76124DFB953F5C
                                                                                                                            SHA1:9E6F3E4D87189A381EA5CA35148E2BC4C2618686
                                                                                                                            SHA-256:5AB1E574C48682E6FEEA216E71B16150335EEA3D23AF856A0E6F71CE715DE137
                                                                                                                            SHA-512:7FF20635476D644CCDF277A9DFDB01DC95FBB46C92C4FD119CEBC16758380935F09B4DD1B6B240E9336465E637AC47CDCA02C32DFC67CA0CCB170B2B17AB89DF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.\/...................\/....R..s....j.V...[/

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\pt_CV.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1626531665973814
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM8E/flMl3ViGj1:Sv1jtBj1
                                                                                                                            MD5:AAE879C1E1523CD47B76124DFB953F5C
                                                                                                                            SHA1:9E6F3E4D87189A381EA5CA35148E2BC4C2618686
                                                                                                                            SHA-256:5AB1E574C48682E6FEEA216E71B16150335EEA3D23AF856A0E6F71CE715DE137
                                                                                                                            SHA-512:7FF20635476D644CCDF277A9DFDB01DC95FBB46C92C4FD119CEBC16758380935F09B4DD1B6B240E9336465E637AC47CDCA02C32DFC67CA0CCB170B2B17AB89DF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.\/...................\/....R..s....j.V...[/

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\pt_GQ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1626531665973814
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM8E/flMl3ViGj1:Sv1jtBj1
                                                                                                                            MD5:AAE879C1E1523CD47B76124DFB953F5C
                                                                                                                            SHA1:9E6F3E4D87189A381EA5CA35148E2BC4C2618686
                                                                                                                            SHA-256:5AB1E574C48682E6FEEA216E71B16150335EEA3D23AF856A0E6F71CE715DE137
                                                                                                                            SHA-512:7FF20635476D644CCDF277A9DFDB01DC95FBB46C92C4FD119CEBC16758380935F09B4DD1B6B240E9336465E637AC47CDCA02C32DFC67CA0CCB170B2B17AB89DF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.\/...................\/....R..s....j.V...[/

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\pt_GW.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1626531665973814
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM8E/flMl3ViGj1:Sv1jtBj1
                                                                                                                            MD5:AAE879C1E1523CD47B76124DFB953F5C
                                                                                                                            SHA1:9E6F3E4D87189A381EA5CA35148E2BC4C2618686
                                                                                                                            SHA-256:5AB1E574C48682E6FEEA216E71B16150335EEA3D23AF856A0E6F71CE715DE137
                                                                                                                            SHA-512:7FF20635476D644CCDF277A9DFDB01DC95FBB46C92C4FD119CEBC16758380935F09B4DD1B6B240E9336465E637AC47CDCA02C32DFC67CA0CCB170B2B17AB89DF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.\/...................\/....R..s....j.V...[/

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\pt_MO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1626531665973814
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM8E/flMl3ViGj1:Sv1jtBj1
                                                                                                                            MD5:AAE879C1E1523CD47B76124DFB953F5C
                                                                                                                            SHA1:9E6F3E4D87189A381EA5CA35148E2BC4C2618686
                                                                                                                            SHA-256:5AB1E574C48682E6FEEA216E71B16150335EEA3D23AF856A0E6F71CE715DE137
                                                                                                                            SHA-512:7FF20635476D644CCDF277A9DFDB01DC95FBB46C92C4FD119CEBC16758380935F09B4DD1B6B240E9336465E637AC47CDCA02C32DFC67CA0CCB170B2B17AB89DF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.\/...................\/....R..s....j.V...[/

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ro_MD.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):140
                                                                                                                            Entropy (8bit):3.6172901478789785
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlyFgmlvlN/eeMKlVj7bmwRmKlMl/FzLDolB3Bf:SvmgoC+AeWl+D3J
                                                                                                                            MD5:C9AD04416D48F3F3DA6EDE6BF0DE3140
                                                                                                                            SHA1:9E71BD328567ED1326639D020FC3521367901F94
                                                                                                                            SHA-256:29090AF3B728DD6D613B3C0C5269DBF7127B38F9B88F57F5131F7EA282735785
                                                                                                                            SHA-512:D8AB2C3AA6F4B163C3FB38E0C9CE4787BE312CC84B9B6A38CC30327CFE651C47DE79E02CE604BFA8A3572134BA4540823C2907727FACD6EB9EEBE4DB9CF2C430
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..I....................I....R..s..s.w.a.h.i.l.i. .(.R... .D... .C.o.n.g.o.).....*.V..I.I....V......P.4.`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\root.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):196
                                                                                                                            Entropy (8bit):4.611742020142585
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlvjlsqEblPp/EXj+JtzeDsH/LEZRtnHC+KgkiblFilF7xFUT9OrD7ATd:Sv6qE8uzew4vc+7koFGTCT9PE8v
                                                                                                                            MD5:E79BF68AFC384525C535D2D648FDEAEE
                                                                                                                            SHA1:9B2F0600AFA8E647142230547D1B203F0A2A5AE2
                                                                                                                            SHA-256:51A9BFAD37156747790AEC44BFE76A0C5B5ED341741AE6DE1427FB181E51E3D0
                                                                                                                            SHA-512:7EDBC482544BCBFBB5CE0430495779C7D87DB572A7CB3F92FDB1390F8DEC3B0FB92D0AE0EACDE00A414A7B9ECE2401E4A3B1B4CF5ECE5C982C79900E5D431786
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................".. ........)...)...............R..s....../d........{.{.{.......".e!..n!....t....................A.`e!.`...`r..`...`...`...`.m.`L..`...P..V.^..........`... ...P...P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ru.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22184
                                                                                                                            Entropy (8bit):4.731542920391909
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:oAjeRYOPIl3aQ9tRp0/cxsT9Pa2E5Xf+Wf+xCYt7:oAUYj99tRpKcxsTVa2E5v+Q+xCYV
                                                                                                                            MD5:89FB6F6C53679CFD7F8EC70353D62535
                                                                                                                            SHA1:21C9512F826AA841C28615008309931E67DF2E8E
                                                                                                                            SHA-256:B85FCD2EC5B4045C9621A9A887B7ED5E06D3545352744ABFBEE9F9AE12AB0408
                                                                                                                            SHA-512:A4A52015C9E859A2E55DF6FA9A3AC37BBE6985610662EC5F5738D33CA452F8CA745DC90F62DCC2F7B830B09254C4F74A85CD3EB6BE9A8D736D0B69A56CA1465C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .<......................4...R..s..2.C...O.>...:.>.<...<.@.>...A.O.=...M.2.5...B.L.O.?...3.0.=.L...3.1.0.O...4.0.7.0...:.0.9.0...:.8.3.0...;.8.A.C...;.>.<.0...<.0.9.O...=.>.A.C...B.8.2.8...1.0.<.C.<...0.G.>.;.8...1.0.D.8.O...1.5.4.6.0...1.8.;.8.=...1.@.0.C.8...1.C.E.8.4...4.8.C.;.0...7.C.=.L.8...:.0.4.6.8...:.0.@.8.1...;.0.=.3.>...;.0.=.=.0...;.5.?.E.0...;.C.E.L.O...<.8.5.=.5...=.L.>.@.>...?.>.8.A.:...E.0.:.:.0...E.0.=.L.1...:.0.9.N.3.0...0.:.>.>.A.5...2.>.;.5.0.8...4.6.5.@.<.0...:.0.9.B.E.8...:.8.:.C.9.N...;.0.E.=.4.0...;.8.F.8.0.=...=.N.9.-.H.C...>.A.5.4.6.8...?.0.3.A.?.0...?.>.=.0.?.5...A.0.@.0.B.8...A.8.4.0.<.0...A.;.5.9.2.8...A.>.@.0.=.8...B.C.@.>.9.>...E.0.=.C.=.C...G.6.C.0.=.L...G.6.C.8.=.L.....8.=.L.8.=.L...'.0.A.B.=.>.5...0.9.=.A.:.8.9...0.@.0.1.8.F.0...2.0.9.A.:.0.O...2.>.4.A.:.8.9...3.>.B.A.:.0.O...3.>.B.A.:.8.9...3.@.0.=.B.E.0...4.0.B.A.:.8.9...4.5.7.5.@.5.B...8.=.C.?.8.0.:...:.C.B.5.=.0.8...<.M.=.A.:.8.9...=.N.=.>.@.A.:...>.4.6.8.1.2.0...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sd.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10204
                                                                                                                            Entropy (8bit):4.852425927529368
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:kkHm5ZyMjyyJ4U1WOo8qCFuIjZdR/77J/ig8iI4CmKBO:kkHILJBho8qC3ZbvJ/ig8soO
                                                                                                                            MD5:DCD011C3A56643E59D0CEA477B271AC5
                                                                                                                            SHA1:4F0EE664AF28C2B4576B01CD55DFEF47F839AEEF
                                                                                                                            SHA-256:026667604E035B3AA364E193CAB04D74DDA68164EB4A64AD86960666D4955514
                                                                                                                            SHA-512:53FC453AEA2CD467D84BD9D74312596429F9025D760E8A842AB8EDD29FC54ECC237993EF12FCCD9467252B86DDDCFE2445A294F7333F1AE03C910EAD515E261E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................R..s..........E.1...'./.H...'.3.H...'.J.H...(.D.F...(.F.J...*.1.....,.J.2...1.H.'...1.H.}...3.G.H...3...H...A.,.J...A.F.4...E.D.J...F...H...J./.4.....J.........'.......F.......J.......H.....4.J...*.'.E.D...*.D...H...D.'.&.H.....'.&.J...".&.1.4...'.2.(.....'.2.1.J...'.A.'.1...'.F...4...'.J.(.F...'.J.A.....'...'.F...'...(.H...(.'.D.J...(.1.E.J...(.4...1...*.E.F.J...*.J.'.~...*.J.*.E...*.J.3.H...*...1.J.....'.3.J...2.H.F.J...3.'...'...3.'./.J...3.3.D.J...3.F...J...3.J.F.'...4.'.E.J...B.'.2.B...D.F...'...D.H.2.J...E.'.1.J...E.H.3.J...E.H.F.....E.J.*.'...E.J...E...F.'.&.H...F.H.H.J...F.J.H.1...G.H.~.'...H.D.H.F...H.H.D.A...H.J.D.4...~.1.4.F...~.D.H.F...~.H.D.4.....'.F.'.....E...'.......J.2.........F.....J.F.4.....'.E.F.....1./.J.....1.J.......D.H.F.....H.1.......H.1.H.....H.E.J.....H.E.......~.J.D.....H...F...'.H...J.'...(.F...D.'.....F.'...'...".&.J.F.H...".3.'.E.J...'.1...F.J...'.D.H...H...'.D.J.H.}...'.H.'...J...'.H.J.1.3...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\shi_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):888
                                                                                                                            Entropy (8bit):4.2198271209621385
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:YpamSuWfhXmwTg/PxoAIn5n09HDCxIIvYDrSo:YplSpfhXmYg/PxoAI5n09HDC6fl
                                                                                                                            MD5:65871B9CAD3C2BDBCA7CC20611513271
                                                                                                                            SHA1:527C21E819BEC5CCE74684249E609898F84C6B79
                                                                                                                            SHA-256:29485F790CCD21207071AC3D258BA22E7137884CF67364DE30D3A9A8DF641D27
                                                                                                                            SHA-512:517169C6EFE007CB9F19A438EBCA124798C5A45393BC315162D2F2CADE47685CAC0A58A47D68492D05492BF9EC603E967A34C6D7FDD392863590496A6FD9C893
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..T.............-......T....R..s..T.a.k.a.n.t...T.a.x.m.i.r.t...T.a.z.u.l.u.t...T.a.[.r.a.b.t...T.a.c.i.n.w.i.t...T.a.f.u.r.s.i.t...T.a.g.r.i.g.i.t...T.a.h.a.w.s.a.t...T.a.h.i.n.d.i.t...T.a.l.i.m.a.n.t...T.a.m.h.a.r.i.t...T.a.n.g.l.i.z.t...T.a.t.a.m.i.l.t...T.a.t.c.i.k.i.t...T.a.t.u.r.k.i.t...T.a.y.r.u.b.a.t...T.a.b.l.c.a.r.i.t...T.a.b.n.j.a.b.i.t...T.a.b.n.c.a.l.i.t...T.a.b.u.l.u.n.i.t...T.a.b.[.m.q.i.z.t...T.a.h.n.c.a.r.i.t...T.a.n.i.b.a.l.i.t...T.a.s.u.m.a.l.i.t...T.a.b.i.l.a.r.u.s.t...T.a.b.i.r.m.a.n.i.t...T.a.f.i.t.n.a.m.i.t...T.a.h.u.l.a.n.d.i.t...T.a.j.a.b.b.u.n.i.t...T.a.s.b.n.y.u.l.i.t...T.a.s.h.e.l.%.i.y.t...T.a.t.a.y.l.a.n.d.i.t...-.@...[.......*.7.B.X.o.....@.....'.........D.Y.......0.[.........A...M.............H.F......T.T.TtU$U8U.U.T.T.T.U.T.T.T.TVU.T...<.Uc6.T...<.U`U.U.UBULU.<...T.UjU.).U.U.U.)...U.U.T.T..j...V....`5..P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\shi_Tfng.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9059918981668114
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMIl66E7lQ/S5rn:Svh66gQU
                                                                                                                            MD5:99429A48939E3A225D47899070309528
                                                                                                                            SHA1:36A1F05D4FCCF23B1BA16BD50E95AFAE57C50C09
                                                                                                                            SHA-256:FA96AEAB1127F8C3AF7390DE4E541F58C54BF15C3F6710613FED47ABE3AFA9BA
                                                                                                                            SHA-512:C704259C73F1F7F75BFDDAB84C0B7B1342623DC13AC03212F05A130BE3CB91737FD770842D5CA97E4065BE4E677CA3CD8994D6B00A9C510B91486CC5B4C5877C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....V...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\so.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10896
                                                                                                                            Entropy (8bit):4.223066769778727
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:RFpdaY3LzattteIemLMdOx4owEgBZ6mAYHo4Jxala8UNL:REY7zWtNeiMdW4oqeIosxala8Ud
                                                                                                                            MD5:C79DED5764E47E5337B4DE89CF3391FA
                                                                                                                            SHA1:F11701CD08D048BB3425CE00588F41DC9D3BBCEA
                                                                                                                            SHA-256:E688614AC9658237F3622F69BACB65363B39715F0B2EEF78395B49DC60F76281
                                                                                                                            SHA-512:5A2F35D6DEEEE49A39D6327D0317B0285C601E97274A81B5CFE4AC8E4F1B9C841FA5BF242111CC1FFBD8370E5FCCF1A8C086712CA05E0249950F45E40CE5B2C9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................q...R..s..B.o.p.o...E.e.w.e...G.u.r.u...H.a.n.i...J.e.e.g...J.i.g.a...L.a.o.o...T.a.a.y...A.g.e.e.m...C.h.a.g.a...D.a.a.n.a...E.m.b.u.u...F.a.a.y.i...J.a.a.m.o...J.a.k.m.a...J.e.j.e.n...K.a.a.k.o...L.u.h.y.a...M.e.e.r.u...R.a.a.w.a...R.u.u.s.h...S.a.a.q.a...S.a.r.m.a...S.e.e.n.a...S.o.o.g.a...T.e.e.s.o...U.r.d.u.u...Z.u.u.l.u...C.a.r.a.b.i...G.i.r.i.i.k...A.s.e.e.r.i...A.y.r.i.s.h...B.a.f.i.y.a...B.a.s.q.u.u...D.u.a.a.l.a...F.u.u.l.a.h...F.u.u.n.j.o...G.a.n.d.h.a...G.u.u.s.i.i...H.a.m.o.n.g...H.a.w.a.a.y...H.o.o.s.t.a...J.a.r.m.a.l...K.a.a.m.b.a...K.a.s.a.a.q...L.a.a.n.g.i...L.u.w.a.d.a...M.a.l.a.a.y...M.a.n.k.i.s...M.a.s.a.a.y...M.e.e.t.a.a...N.u.w.e.e.r...R.u.n.d.h.i...S.h.i.l.h.a...S.h.o.o.n.a...T.a.a.j.i.k...T.a.a.t.a.r...T.a.i.i.t.a...T.a.m.i.i.l...W.o.o.l.o.f...L.a.a.t.i.i.n...A.x.m.a.a.r.i...B.a.a.n.g.l.a...B.a.s.h.t.u.u...B.i.r.i.t.o.n...B.o.o.l.i.s.h...F.a.a.r.i.s.i...F.a.r.o.w.s.i...H.a.n.g.u.u.l...K.a.b.a.y.l.e...K.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sr.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10552
                                                                                                                            Entropy (8bit):5.481790059993295
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:TzpGQ/KrMsklUEhe4AgcETZ5lb/X/Yepwn0GK7lE:X/j84Zf/XgUiRSlE
                                                                                                                            MD5:92476709B9A64A0E58E9583DBF972935
                                                                                                                            SHA1:B145EF35285D2A078B8AAC8FB7AEB2F44DE78E6E
                                                                                                                            SHA-256:B2DDA09C087E38D771A63333BBC8910B8DFEA0D2C688A0FF5791B84A3F16AEF1
                                                                                                                            SHA-512:A154D280A7ACA93287F89C2011E51D103C03CE4FC1100D602382046B33B49DBD468ECFE22579BB8D908F6C236F17826EF8A44C4211B9871C050237F7283A760E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................2.. .L......F...F.........L.....R..s.._.C...c.c.p...E.0.=...X.0.>...0.8.=.C...1.5._.0...3.5.5.7...:.@.8.>...R.C.;.0..._.0.<.>...!.:.0.C.7...1.8.:.>.;...2.C.=._.>...5.<.>._.8...5.@.7.X.0...:.0.8.B.8...;.C.X.8.0...>.A.0.3.5...?.0.H.B.>...E.0.8.4.0...G.8.?.G.0...G.C.G.:.8...Z.0.=._.0..._.>.=.3.0.....>.B.8.:.0...0.F.5.H.:.8...1.0.D.8.X.0...2.0.;.C.B.0...2.>.4.A.:.8...3.0.3.0.C.7...5.:.0._.C.:...5.D.8.G.:.8...8.=.C.?.8.:...:.@.8.H.:.8...>._.8.1.2.5...?.>.Y.A.:.8...A.8.A.8.:.0...A.;.5.X.2.8...E.0.=.C.=.>...H.0.=.A.:.8...X.0.?.A.:.8... .5.A.8.X.0.=...0.1.E.0.A.:.8...0.:.0.=.A.:.8...1.;.8.=.A.:.8...1.>._.?.C.@.8...2.>.;.0.?.8.:...2.>.;.0.X.B.0...3.2.0.@.0.=.8...8.1.0.=.A.:.8...8.=.3.C.H.:.8...:.0.7.0.H.:.8...:.2.0.Z.0.<.0...:.5.;.=.A.:.8...:.C.<.8.G.:.8...:.C.B.5.=.0.X...;.C.8.A.5.Z.>...<.>.E.>.G.:.8...=.3.0.<.1.0.X...B.0._.8.G.:.8...E.<.>.=.H.:.8...G.0.3.0.B.0.X...G.8.=.C.G.:.8...H.:.>.B.A.:.8...X.0.=.3.1.5.=..._.C.0.=.H.:.8...=.0.C.@.C.A.:.8...0.<.5.@.8.G.:.8.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sr_BA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.8579990406079685
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/ERlSU5YMi3:SBtkJYlU8g8l/6/5YMu
                                                                                                                            MD5:A15124D06FD24A4A238B2EB31920CF34
                                                                                                                            SHA1:AD43C7F01AE88C5BBA503E599CEDE23898ED674C
                                                                                                                            SHA-256:E1348D8D920E82A1D6C023A8F2D6A22DD87F0F22CF4DDE990D52A08105EAD5FC
                                                                                                                            SHA-512:DBA7DD33AA90BDF0CD1F6528A9E6AA30A56930744E917AE70B6755C48611F3FCBA311914BD53FC546E569A231908052CEE302FF50FE37CF90174973DEC0449F5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s..s.r._.C.y.r.l._.B.A...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sr_Latn_ME.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):144
                                                                                                                            Entropy (8bit):4.712820713570597
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tln0sthjljl/y/Vidi5tmpaPhYAD7i3J7neEIRF:Svkswh5tegiFnezj
                                                                                                                            MD5:6784226232236569B7296713F1858249
                                                                                                                            SHA1:C43FC2D97DD78D8E097447C463FF0CEE8004F5BE
                                                                                                                            SHA-256:0A7C74E48E8DBD95E94E8B017D204A9C04073836B7D052B50AE5B7E257EE490E
                                                                                                                            SHA-512:4B92CBB1E77AC89E6F3B9534F11166541D0DA9E76F669C61F88A12718015F58AD5054F1FC131BE58C27445EC6B1D868CE154248C33B3125D75B3051B44EE81AC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .h....................h.....R..s................z...H...8.j.}...fG.L.N.%...........a...g.}.....V......P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sr_XK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.8779990406079685
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/ERlSU5Wul/k/3:SBtkJYlU8g8l/6/5Wutkv
                                                                                                                            MD5:66806A37CE763270B3A15362E29C0DCA
                                                                                                                            SHA1:E573AD547E059776C19D58B72E8C9CD375D6969D
                                                                                                                            SHA-256:B0E0D0CA4AE4759F834840A0507CE38B2E0312610AF678974EF669A8A23B5DD4
                                                                                                                            SHA-512:CACF1BEC380379A5944A02B298AFE4C5D114D6DD1DEF785B43274366C362AA936A6F564A6E6A8A7704DD4ADD2E1868E9103C0645C2C5587CA03CF4D9A882C35F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s..s.r._.C.y.r.l._.X.K...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sv_FI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):188
                                                                                                                            Entropy (8bit):3.5488868316723865
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tldF+lE/ll03098lXlhfkWVtP5T86Hts1so0AUlyt2lH9Kl1d:SvOlfu0Xr3Vl5Tng67i2avd
                                                                                                                            MD5:F16147C91B5B9ED819C0BC42667B4144
                                                                                                                            SHA1:4A1DD125B5B4523E0ADD16EC5318642A03607170
                                                                                                                            SHA-256:49EF275FD720F8A6326BA408E726F15D45DD66CE03A82777E1B2E29C30C1A97B
                                                                                                                            SHA-512:3D3E1522BDAC78A1925036CFC805B7DF065234C0184933ED9EA6355D944A68750733625E2F5770FF741221095732BBF6EAA9C88DF1CE4738166F172BADA19605
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................ .. .\/.....'...'.........\/ ...R..s..t.i.d.s.z.o.n...k.i.r.g.i.z.i.s.k.a...p.e.r.s.i.s.k.-.a.r.a.b.i.s.k.a.......]/....e/..e.p/........V...%..P(..P+..P[/.`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):13012
                                                                                                                            Entropy (8bit):4.562190553715316
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:CyTFRPBRgfVOroQYzUak2E6uvmDw/CkG2HprJZV8D/ib40uO6vCKq9c:CMFRiVOroQYze2E6EmDw6IHplZiDz0J2
                                                                                                                            MD5:804938AA06806DF4F177526C7B8A8C07
                                                                                                                            SHA1:257C7D7986B4CDDB6FF48C0E5DEF89EAAB55947E
                                                                                                                            SHA-256:8E4E4FB04850ACFD87BEC9893EA7BF29541350C24CE966E593CC7298FB495901
                                                                                                                            SHA-512:04041E965DDD43891A9DE5A6B81A092B8EA3F8558163E91F8F9E5CAA37D5855CFCAC1B61B5FCE68B3676E6A69E2DB9FFD8F804E5728EAA828F457F3966F32E96
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................q...R..s..K.i.a.s.u...K.i.e.w.e...K.i.f.o.n...K.i.h.a.n...K.i.k.o.m...K.i.v.a.i...K.i.y.a.o...M.y.a.m.a...K.i.a.i.n.u...K.i.b.u.l.u...K.i.e.m.b.u...K.i.f.i.j.i...K.i.f.i.n.i...K.i.h.i.t.i...K.i.i.b.a.n...K.i.j.u.l.a...K.i.k.o.m.i...K.i.k.o.r.o...K.i.m.a.n.x...K.i.m.a.r.i...K.i.m.e.r.u...K.i.n.a.m.a...K.i.s.e.n.a...K.i.s.h.a.n...K.i.s.o.g.a...K.i.t.e.s.o...K.i.j.o.j.i.a...K.i.l.a.o.s.i...K.a.l.e.n.d.a...K.a.r.j.a.l.a...K.i.a.k.a.n.i...K.i.a.k.o.l.i...K.i.a.r.a.m.u...K.i.a.v.a.r.i...K.i.b.e.m.b.a...K.i.c.h.e.k.i...K.i.f.a.r.o.e...K.i.f.l.e.m.i...K.i.g.a.n.d.a...K.i.h.a.w.a.i...K.i.j.a.l.u.o...K.i.k.i.s.i.i...K.i.k.o.n.g.o...K.i.k.r.i.k.i...K.i.k.u.r.d.i...K.i.m.a.l.e.i...K.i.m.i.s.r.i...K.i.m.o.n.g.o...K.i.n.i.a.s.i...K.i.n.i.u.e.a...K.i.n.o.r.w.e...K.i.r.a.n.g.i...K.i.r.o.m.b.o...K.i.s.a.n.g.u...K.i.s.k.o.t.i...K.i.s.o.t.h.o...K.i.s.w.a.t.i...K.i.t.o.n.g.a...K.i.v.u.n.j.o...K.i.y.i.d.d.i...K.i.l.a.t.i.n.i...C.h.a. .j.a.d.i...K.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\ta.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22048
                                                                                                                            Entropy (8bit):4.647099492702514
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:e8hupi1Jb+CmD8MmuI8gbq/2CJFWgCdr3P7nT/gXbyb4jiYjOAnOH4nSbQirXOWP:e8hR1JbLmD83R5bKCdkOsjQxbQire9PA
                                                                                                                            MD5:486E5CE7C7A4F22A67EBE6594B253688
                                                                                                                            SHA1:E8F529F28A24CDB7FD3205DF56CAB5139172F1D9
                                                                                                                            SHA-256:6DEED9C5BE6C536E49FB4624DDDAF329A055FE072717BA061443BC4044FCF2A1
                                                                                                                            SHA-512:235B42E1FE26F18726143B8BCB0A5CB647F03F405FB09CEADE09B411A2ACAF9FE4A9594DDD5AEDD544F90C7DDDD4F8622078FFC83A1D37BF17EDD575D28A765A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................l.. ........................C...R..s....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\teo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):284
                                                                                                                            Entropy (8bit):5.798176336157329
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvKgeWt5AvxROtZxCt83DFxTZN6M46izrxZiYtXl03Qf:jgeWt5Av8bZNiJzrHiYtXS3Qf
                                                                                                                            MD5:C7A09ED3C5AC1866BB6545BB7EDE628A
                                                                                                                            SHA1:7254D148502925A8EAC1FF9783CF1567215253F5
                                                                                                                            SHA-256:B389A5D1AF38E0A37D2571B4C402840BEB1145470C4A9C877709C01B5F891AED
                                                                                                                            SHA-512:B02847C320DA6452DDCA4686D274B159A451E894A733981CEA1C91CB66F6B19A33A1508B45030ED2E77282263A1FA683F04BEAE8D3A985781B813E88D81A7B6B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................;.. ........?...?...-.......;...R..s..K.i.t.e.s.o...-.@...[.......*.7.B.X.o.....@.....'.........D.Y.......0.[.........A.M...............H.F........#..G.G.#.#.H..2.G.......0.\...G....|G..s0..]#i0K0A0..}0R....#.....G.#.0...\.#..........V......P...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\th_TH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.411243631352237
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/E9:SBtkJ1li6gml/o
                                                                                                                            MD5:A0E7F0023EFE9D9DA802A0C5A941F8CE
                                                                                                                            SHA1:E4522C97B99704605469449C21AEEF8E03A0AD3E
                                                                                                                            SHA-256:756032017E2D9DEB9EC1508DAFB605009EADF6D859FF309BBCD6E49BB2D8D9F2
                                                                                                                            SHA-512:2B06564FB675F51D96E9945A303D9AADAEABB8173222AC644AC3415D5AC1AEC958D70F651A5C85561CDD79E0F4B713D43117332A8536A251F4FB48800076AB01
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....s...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\to.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):35892
                                                                                                                            Entropy (8bit):3.807820019021994
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:zaR9JONhum5W55JBCvzqWwbd/E/XVELdiP63:Okhums5cHwbd+XCIP63
                                                                                                                            MD5:D932FFD4F3188AFCB7C82D6928A0A0CB
                                                                                                                            SHA1:DFC5CBB4578486887138635C839C2B00C28E92C8
                                                                                                                            SHA-256:DA642E784508550C486E48CC1EC693092A0A6602C6CDE1DE2BA9101410C4A6D8
                                                                                                                            SHA-512:DE53C31CFF24F6B7787DBC985B387EA74280172EEE88AD6700B8538533A293ABF2B736E5D8BD7AEAE4AB6205B3B561285BFFF7A0623D00CD5401E4D31ABCD5C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB.................". .........#...#..f...........R..s..f.i.k.a...L.e.a.:. .{.0.}...f.a.k.a.p.u.t.a.....u.n.i.k.M.t.i...f.a.k.a.t.a.n.i.k.i...l.e.a. .f.a.k.a.k.....l.e.a. .t.u.i.f.i.o...t.a.k.a.i. .h.o.u.a...f.a.k.a.s.+.p.i.n.g.a...f.a.k.a...i.n.i.t.i.a...f.e.s.i...i.l.a.i.n.e...l.e.a. .f.a.k.a.l.a.u...l.e.a. .f.a.k.a.l.u.o...l.e.a. .f.a.k.a.l.u.....l.e.a. .f.a.k.a.v.a.i...t.o.h.i. .m...h.i.n.a...F.e.i.t.u...u.:. .{.0.}...a.n.g.a. .p.a...a.n.g.a...f.a.k.a.-.i.s.o.8.6.0.1...f.a.k.a.m.o.h.a.m.e.t.i...f.i.k.a. .f.a.k.a.l.a.u...f.i.k.a. .l.a.u.l.a.h.i...l.e.a. .f.a.k.a.f.i.s.i...l.e.a. .f.a.k.a.f.u.l.....l.e.a. .f.a.k.a.h.u.p.a...l.e.a. .f.a.k.a.k.a.i.o...l.e.a. .f.a.k.a.k.a.k.o...l.e.a. .f.a.k.a.k.a.t.o...l.e.a. .f.a.k.a.k.e.l.+...l.e.a. .f.a.k.a.k.i.k.a...l.e.a. .f.a.k.a.k.o.l.o...l.e.a. .f.a.k.a.k.o.m.e...l.e.a. .f.a.k.a.k.o.m.i...l.e.a. .f.a.k.a.k.u.s.+...l.e.a. .f.a.k.a.k...s.i...l.e.a. .f.a.k.a.k...p.o...l.e.a. .f.a.k.a.k.+.s.....l.e.a. .f.a.k.a.l.a.s.u...l.e.a. .f.a.k.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\uz_Cyrl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):7692
                                                                                                                            Entropy (8bit):4.796322836638135
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:PQM4Kp3t925Ir6GwuPt6oFOo00kp1roug8Ja/cetkriedVXWOEgVobRpt:PQTKp3+A69uDgKkpacPbddWGyTt
                                                                                                                            MD5:D86F82633086F6653282898C71CA1D9A
                                                                                                                            SHA1:2915C9E959A5D61AB0D69320558E1D6765250EF7
                                                                                                                            SHA-256:6EB7787CDD1B547E12B871AB2C643CA06CA25BEF8D05C1BDA01F7A4717CC0799
                                                                                                                            SHA-512:F791F0AF84D08989E7CBF5E184012333AF38A3A7DED413D0C7C6B8339B3C93B7470FD06E50EDB1953B1B148A4AC78C53A7EAA49C5B250F7D0B90240C82AF6590
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................k.. .\......{...{...-.....\.f...R..s....0.>...".0.9...%.0.=.....@.0.1.....@.8.O...%.<.5.@.....=.>.=.../.?.>.=...:.0.6.8...:.8.G.M...;.C...O...>.4.8.O...>.7.0.@...G.5.2.0.....@.<.0.=.....8.@.8.;.....>.B.8.=...".0.0.=.0...".0.<.8.;...".8.1.5.B...0.;.5.C.B...0.A.C.G.0...2.C.=.6.>...4.0.B.G.0...8.1.8.1.>...8.4.4.8.H...:.8.:.C.N...;.C.H.0.9...<.>.A.A.8...<.M.=.G.0...B.0.9.G.0...D.8.=.G.0...D.C.;.0.....G.5.E.G.0...M.2.5.G.0.....0.1.0.H.....8.=.4.8.....@.C.7.8.=.....>.@.5.9.A.....L.O.=.<.0...".5.;.C.3.C...#.<.C.<.8.9...%.0.=.3.C.;...0.2.0.@.G.0...0.3.5.<.G.0...0.4.8.3.5.9...0.:.0.=.G.0...0.@.C.<.8.=...0.D.0.@.G.0...1.0.;.8.G.0...1.0.A.:.G.0...1.5.=.0.G.0...1.;.8.=.G.0...1.>.4.>.G.0...3.@.5.:.G.0...:.>.@.=.G.0...:.@.8.:.G.0...:.Q.;.=.G.0...;.0.>.A.G.0...<.5.@.C.G.0...<.>.3.0.2.:...=.8.C.M.G.0...=.C.M.@.G.0...A.0...>.G.0...A.5.@.1.G.0...A.8.=.4...8...B.C.@.:.G.0...C.M.;.A.G.0...D.8.6.8.G.0...D.>.@.A.8.9...E.<.5.@.G.0...G.8.3.0.G.0...G.C.C.:.G.0...H.0.9.5.=.=...H.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\uz_UZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.925547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/Egl6lwl3l/i3:SBtkJYlU8g8l/Dl6K/u
                                                                                                                            MD5:A32CF3695027572FBBB3676506E21897
                                                                                                                            SHA1:EBDBD013BC651EE05A5B28DF31EA4B9E4FEBBD71
                                                                                                                            SHA-256:51D0D1CCEEA79E7FBF0D679BB3570B8EB10AD9D9B44A687197CFC540DFA26796
                                                                                                                            SHA-512:E5CE86F52CCB1B77CC53D68C421DD19BAF79AF7AC2AA7181737A93900D4BC463EC0CBDB582EDD3A87687B55E03775A7CB6DDA55137C7900829DE2754A7B011AE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s..u.z._.L.a.t.n._.U.Z...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\vai_Vaii.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9059918981668114
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMIl66E7lQ/S5rn:Svh66gQU
                                                                                                                            MD5:99429A48939E3A225D47899070309528
                                                                                                                            SHA1:36A1F05D4FCCF23B1BA16BD50E95AFAE57C50C09
                                                                                                                            SHA-256:FA96AEAB1127F8C3AF7390DE4E541F58C54BF15C3F6710613FED47ABE3AFA9BA
                                                                                                                            SHA-512:C704259C73F1F7F75BFDDAB84C0B7B1342623DC13AC03212F05A130BE3CB91737FD770842D5CA97E4065BE4E677CA3CD8994D6B00A9C510B91486CC5B4C5877C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....V...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\vi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):31176
                                                                                                                            Entropy (8bit):4.660094340995951
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:v/dvgQPa9mvYvTqeyyxqselsgM+LeYa7u4bc8zq2p5oK8S1Pm4MuaLWvTjRqU3Fq:vlvgQlYDH1MeLq492U5oSR5W6ymqx6T4
                                                                                                                            MD5:B7B06373C3013F642CA12338782065D9
                                                                                                                            SHA1:3392B47820E92430656DD73217A67C8325C003E6
                                                                                                                            SHA-256:58CE9110E0501D7EF9B687BFC0EC8FE867664100023D87769BFD361422F0CADB
                                                                                                                            SHA-512:EF9EB18BAA3DB08B6B7B8056CA36334509C25E47B9CAE60206203DA5A5A10D43BC17CCD253EDCD86ABE728CFD3E9B95E247972E87C03FE760F1049BE19BBAEA5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................V.. .h......j...j...)..........R..s..S.....A.d.l.m...A.g.h.b...B.h.k.s...D.o.g.r...E.l.b.a...E.l.y.m...H.a.t.r...L...c.h...M.a.h.j...M.a.k.a...M.a.r.c...M.e.d.f...M.u.l.t...N.a.n.d...O.s.g.e...P.a.u.c...Q.a.a.g...S.i.d.d...S.o.g.d...S.o.g.o...S.o.y.o...W.c.h.o...Z.a.n.b...B.A.R.L.A...C.O.R.N.U.....a. ...m...A.O.1.9.9.0...A.R.A.N.E.S...A.S.A.N.T.E...A.U.V.E.R.N...C.I.S.A.U.P...C.R.E.I.S.S...C.h... .D.i...G.A.S.C.O.N...G.R.I.T.A.L...H... .m...t...N.I.C.A.R.D...U.N.I.F.O.N.......n. ...m...A.K.U.A.P.E.M...B.A.L.A.N.K.A...C.h... .S...p...C.h... .H...n...C.h... .L...o...C.h... .V.a.i...G.R.C.L.A.S.S...G.R.M.I.S.T.R...H...n. .l...m...L.E.M.O.S.I.N...M...i. .g.i.....P.R.O.V.E.N.C...T.i...n. .t.....{.0.}. .n...t...I.J.E.K.A.V.S.K...B.A.S.I.C.E.N.G...C.O.L.B.1.9.4.5...C.h... .B.a.l.i...C.h... .C.h...m...C.h... .H.a.n.b...C.h... .J.a.m.o...C.h... .J.a.v.a...C.h... .N.. K.o...C.h... .O.d.i.a...C.h... .T.h...i...F.O.N.K.I.R.S.H...G.i...n. .t.h.....I.V.A.N.C.H.O.V...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\yue_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.812172957387978
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlgelU8gl8l/Eel6lafwn:SBtkJZlU8g8l/1l6lSw
                                                                                                                            MD5:3C90F7377649E8713D7A66E5B94AAEF8
                                                                                                                            SHA1:F57F958BFAEA60CE727BDA78A58656C4B21579EA
                                                                                                                            SHA-256:97C7321D1677C201FB9B68FF38D9BBA91D879FD3F84280F5BDD39F3DE446CA3F
                                                                                                                            SHA-512:EC4308EE40032024C4FE9859C10CC74BBE7D8A3CC3F26BB517B243B682FBB954BC4599D67760303E7ADFE51BA3E6F88094C8ACEF0BEBA2F391F9B09C190E2183
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s..y.u.e._.H.a.n.t._.H.K.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\yue_Hans.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12684
                                                                                                                            Entropy (8bit):6.787165028955761
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:zU21Sr+dcpQdxO1wqsLGPWl0skTu7N9OrZ3Ta/HvRH0aFSUB:zxYm7dxOwGuyk/PdzJB
                                                                                                                            MD5:EC54D352E1595EF0AFA846E478726AC8
                                                                                                                            SHA1:3E54BE34AF6225780594917FF112F31AAF434B20
                                                                                                                            SHA-256:8B49DCBA77A78A888AD07872DB057C32BA5D8EB51AAABA2B10B9179CC1347380
                                                                                                                            SHA-512:BA1C5B7B82A5DCDEB9B082441768DD370A7DC19AE934E0C607A81B913CA7F2065395E28C31F7B6715A6FE9644F1A492F5D2897F5902E1A4CF72CFC6D82D95F92
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................G.. ........[...[...[...........R..s...e.e...e..0N.e..[O.S...O.e..hQb_..lQ6R..lQ.S...Q.S..`S.e...S.l..4T....X.e.._[.e...[.e...c.e..pe<P...e:S..Il...Xn...vt.e..5u.....{SO...|...A~SO..,..e..'..^..c....._.e...\..e...](..e....8u.e..(....e..l..l.e...NaS.e...N(u:S...NLu.e..9N...e..LN...e...NU..e...NP..e...O.Y.e...O.^.e...O.s.e..[OW..e...P.T.e...P.b.e..KQ..e..pQZS.e..pQ.].e...Q._.e...Q.\.e...Q.c.e...R.g.e...R.e.e...R.~.e..WS.\.e..ZS.Y.e..aS.Y.e..aS.Z.e..aS.^.e..aSwc.e..aS4t.e..aS...e..bSeY.e..bSRf.e..bS..e..pS<\.e...S...e...STX.e...TyQ.e...T...e...T._.e...VE..e...VbS.e...W.Q.e..-WQY.e..NW.R.e...WpQ.e...W.~.e...W.R.e..GY.R.e...[aS.e...[.[....[...e...[.b.e...[yr.e...[.V.e...])R.e...^.t.e..r^...e...^.Y.e..i`.^.e..NbNb.e...byQ.e...b...e..wcKQ.e...c+Y.e...c.Y.e...d.N.e...e...e...eNm.e...e.b+Y...e,g.S...f.R.e...f.\.e...f...e...g.T.e..1g.b.e...g!X.e...g.^.e...g.R.e...h.P.e..9h.....Qh.S.e..Qh.b.e...h...e...j.~.S..'k.u.e..Lk._.e...k<\.e...k.g.e...k)R.e...l

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\zh_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640495
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMu86E7lb1y:Svd86gRy
                                                                                                                            MD5:6A7D6D2ED1DAC4F1FC3433AF4AD9EA61
                                                                                                                            SHA1:72AC982A0486B52D53A67CDD50C8D0072128202F
                                                                                                                            SHA-256:AC05B5309D3D2D1ED26197B7387015779873FE5AD798D11AAFB24883293998FD
                                                                                                                            SHA-512:C8AA478ACB70DC1F0FFE948CC8AEB075FCB3FA01E927B8C2554DAA6D305FE956BED73E55ADB129C2071DC70DE4AC1CF82826AE90CA2EE20F3BB5DF5051C66100
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..W....................W....R..s.......W

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\zh_Hant_MO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.162653166597382
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMullNiHyC:SvdXC
                                                                                                                            MD5:F7824A6561441504F1ED9A2CF43149F2
                                                                                                                            SHA1:EC9E05A4DA7636FB737666D40461FD8447F0849E
                                                                                                                            SHA-256:849C7B03350D7AD6191B21CB38AE728D7469A2C7B2B51611C21A4BC9FF2FCCF4
                                                                                                                            SHA-512:872C2196F54F0C87844CD75E6878385D4BB821EE5431BFDB5DA7B7BE0821EE1758D285573D798B1C3508D41C8AE4CD3E66CFD8D5F086E3BA5D3F5F8075CD2A6C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..W....................W....R..s....j.V..W#0

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\zh_Hant_TW.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.411243631352237
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/E9:SBtkJ1li6gml/o
                                                                                                                            MD5:A0E7F0023EFE9D9DA802A0C5A941F8CE
                                                                                                                            SHA1:E4522C97B99704605469449C21AEEF8E03A0AD3E
                                                                                                                            SHA-256:756032017E2D9DEB9EC1508DAFB605009EADF6D859FF309BBCD6E49BB2D8D9F2
                                                                                                                            SHA-512:2B06564FB675F51D96E9945A303D9AADAEABB8173222AC644AC3415D5AC1AEC958D70F651A5C85561CDD79E0F4B713D43117332A8536A251F4FB48800076AB01
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s....s...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\zh_MO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.925547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/E7Rysh3:SBtkJYlU8g8l/A9
                                                                                                                            MD5:213DE4A1ECC8A496153A51F4B2D263DB
                                                                                                                            SHA1:378FAE5458D865287F39894A67342711FD28EF45
                                                                                                                            SHA-256:6C119D44F243C92115286A9A360648640C7CEB0949EEAD9CD823202168389606
                                                                                                                            SHA-512:A09E5EACB5F967884DCBB23722DE3AEBEFB976971911F4D330CE9F9A1DBFB60A9560EC6BA4C7D1CF4DA7D0B6BE389484717B55B65D3AC6AA12136E1109835E7C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................R..s..z.h._.H.a.n.t._.M.O...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\zu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10896
                                                                                                                            Entropy (8bit):4.848304799348323
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:EFugFaBLsBkqhFjbD/uZnxd4q6DN6W+qG0RxKw5jmieQ3IXkkHJ61D:cuiiLseiFfD/u5xd4q6DN6W+uRxKRyYc
                                                                                                                            MD5:D04534CBE1DF91398D60A89FEB773C3D
                                                                                                                            SHA1:FB1E3D2FCBE3D83B70344F0445973F5DE4449096
                                                                                                                            SHA-256:788C5AA080BCD6296C7F8F980A37524D449A71F5D6736E9DB9D8B1D5AF2FE9A7
                                                                                                                            SHA-512:7CBF63A16B0A063D5BE87526AF58A844DB2A0CEF27463C2A01F852CDFB2138F5E0941C146676F5BD02054CEA095E60E7683E3857E758E58EBBCF9D95628803EB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................`...R..s..I.-.B.G.N...i.s.i.-.H.a.n...i.z.i.m.i.l.i...o.k.o.s.i.k.o...i.s.i.-.T.h.a.i...i.s.i.-.A.k.a.n...i.s.i.-.I.g.b.o...i.s.i.-.M.a.r.i...i.s.i.-.U.r.d.u...i.s.i.-.G.r.e.e.k...i.s.i.-.T.a.m.i.l...I.k.h.a.l.e.n.d.a...I.k.h.a.r.e.n.s.i...i.-.E.n.g.l.i.s.h...i.s.i.-.G.u.s.l.i...i.s.i.-.I.r.i.s.h...i.s.i.-.K.o.n.g.o...i.s.i.-.M.a.l.a.y...i.s.i.-.W.a.r.a.y...{.0.}. .. .A.l.l...i.s.i.-.A.r.a.b.i.c...I.z.i.n.o.m.b.o.l.o...U.l.i.m.i.:. .{.0.}...a.m.a.s.i.m.b.u.l.i...i.s.i.-.A.z.e.r.i.a...i.s.i.-.F.r.e.n.c.h...i.s.i.-.G.e.r.m.a.n...i.s.i.-.K.y.r.g.y.z...i.s.i.-.N.e.w.a.r.i...i.s.i.-.P.o.l.i.s.h...i.s.i.-.Y.o.r.u.b.a...H.l.e.l.a. .k.o.n.k.e...i.-.F.u.l.l.w.i.d.t.h...i.s.i.-.A.l.b.a.n.i.a...i.s.i.-.A.r.m.e.n.i.a...i.s.i.-.B.e.n.g.a.l.i...i.s.i.-.B.u.l.g.a.r.i...i.s.i.-.C.h.i.n.e.s.e...i.s.i.-.F.i.n.n.i.s.h...i.s.i.-.G.a.l.i.c.i.a...i.s.i.-.H.a.i.t.i.a.n...i.s.i.-.K.o.n.k.a.n.i...i.s.i.-.K.u.r.d.i.s.h...i.s.i.-.P.e.r.s.i.a.n...i.s.i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lb_LU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lkt_US.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ln_AO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lo_LA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\luo_KE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lv_LV.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\mas_KE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\mer_KE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\mg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2808
                                                                                                                            Entropy (8bit):5.678019583191219
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:rcHAlKB1d8GlD48r0l/gh454L0cl4LcBXqhuH/HyJ2JO6HmXdm5:ggWVm8gdsdl4wXqT+OQ95
                                                                                                                            MD5:B7A53C5BF8FFFEBD3B3A3575E406F2AF
                                                                                                                            SHA1:EBB6199CADAE6F12F9C4714B28115FEEDB277B61
                                                                                                                            SHA-256:CD084B89A2E2A83CCC11D876DAAE11FF1D0366B8F67A4DEC2EDFBE0716C3C531
                                                                                                                            SHA-512:C6FB7908DCCC1BD3B14FDEF7A3AB97DFBC6BD2078DC35E17D1CC8C5D5EC799DA3C544B0F8469DDB054DA33532FB963F11CA85331FE413D1C9A14887A1006334F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................+................M.e.y...Z.o.m...A.o.g...J.o.l...J.o.n...O.r.a...A.l.a.h...A.l.a.k...A.l.a.r...J.o.n.a...Z.o.m.a...A.n.i.o...A.l.a.t.s...J.o.l.a.y...A.n.d.r.o...O.m.a.l.y...T.a.o.n.a...A.p.r.i.l.y...M.a.r.t.s.a...V.o.l.a.n.a...A.l.a.h.a.d.y...J.a.n.o.a.r.y...O.k.t.o.b.r.a...M.i.n.i.t.r.a...A.l.a.r.o.b.i.a...A.s.a.b.o.t.s.y...D.e.s.a.m.b.r.a...F.e.b.r.o.a.r.y...N.o.v.a.m.b.r.a...S.e.g.o.n.d.r.a...A.l.a.k.a.m.i.s.y...A.o.g.o.s.i.t.r.a...S.e.p.t.a.m.b.r.a...H.e.r.i.n.a.n.d.r.o...R.a.h.a.m.p.i.t.s.o...A.l.a.t.s.i.n.a.i.n.y...A.l.o.h.a.n.. i. .J.K...A.o.r.i.a.n.. i. .J.K...[.c. .q. .u. .w. .x.]...T.e.l.o.v.o.l.a.n.a. .f.a.h.a.r.o.a...T.e.l.o.v.o.l.a.n.a. .f.a.h.e.f.a.t.r.a...T.e.l.o.v.o.l.a.n.a. .v.o.a.l.o.h.a.n.y...+.[.A. .B. .D. .E. .F. .G. .H. .I. .J. .K. .L. .M. .N. .O. .P. .R. .S. .T. .V. .Y. .Z.]...A.[.a. ... ... .b. .d. .e. ... ... ... ... .f. .g. .h. .i. ... ... ... .j. .k. .l. .m. .n. ... .o. ... .p. .r. .s. .t. .v. .y. .z.].....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\mg_MG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\mgh.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1688
                                                                                                                            Entropy (8bit):5.056917531863066
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:rk2pmjsSeNjpr2E6DDMxSxVxo5+c9EzuxEzV0lDOXKzFeGXK2EyEZpl0ezeCR:rkemjKNjpqE6PMxSxVxo5+c9ESxEp0k/
                                                                                                                            MD5:EAD5D7580E3C134B0111067E96716565
                                                                                                                            SHA1:C68B589B9C15E1D6A38A826608FF3A4C2B084EA4
                                                                                                                            SHA-256:B9F60530043A737B639276EF9CE5BB108B0132159E7377F704C0716D56767E05
                                                                                                                            SHA-512:5D879FD1ABC8CC928C4525D495ABD1B421B309E6B7C79B811D8A929F4F4DDB79CE37FBBCD23DFC1A9B5665BFA5842E22DD0291303C4293CF52A05A8812A4A70E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................P........H.Y...Y.Y...A.r.a...C.h.e...K.u.m...K.w.a...M.o.c...M.o.j...N.a.n...R.a.r...T.i.s...U.n.a...Y.e.l...i.s.a.a...y.a.k.a...m.w.e.r.i...S.a.b.a.t.o...l.e.l.. l.o...m.e.. l.l.o...n.i.h.u.k.u...k.a.l.. l.a.i...n.. c.h.a.n.a...w.i.c.h.i.s.h.u...i.s.e.k.u.n.d.e...A.r.a.h.a.m.i.s.i...m.c.h.o.c.h.i.l.. l...Y.o.p.i.a. .y.e.s.u...i.w.i.k.i. .m.o.c.h.a...H.i.n.a.p.i.y.a. .y.e.s.u...M.w.e.r.i. .w.o. .k.u.m.i...M.w.e.r.i. .w.o. .n.a.n.e...M.w.e.r.i. .w.o. .s.a.b.a...M.w.e.r.i. .w.o. .t.i.s.a...M.w.e.r.i. .w.o. .k.w.a.n.z.a...M.w.e.r.i. .w.o. .u.n.a.y.e.l.i...M.w.e.r.i. .w.o. .u.n.e.r.a.r.u...M.w.e.r.i. .w.o. .u.n.e.t.h.a.n.u...M.w.e.r.i. .w.o. .u.n.e.c.h.e.s.h.e...M.w.e.r.i. .w.o. .k.u.m.i. .n.a. .m.o.j.a...M.w.e.r.i. .w.o. .k.u.m.i. .n.a. .y.e.l.. l.i...M.w.e.r.i. .w.o. .t.h.a.n.u. .n.a. .m.o.c.h.a...n.i.h.u.k.u. .n.o. .m.w.i.s.h.o. .w.a. .w.i.k.i.........NN....k..)...4.wEy................................!.$.....0............. .'.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\mk_MK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\mr.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18956
                                                                                                                            Entropy (8bit):5.810867234104039
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:IHiKBMPHKIb6qyMQo2uvNsXiOn019ZB9eu6WfbC4ffUR5QYqbLTZF00DrYc7iYly:wIbW6NsXiH3rjC4KQYARfzly
                                                                                                                            MD5:84282F62A1AA229A48F931C7018D2C87
                                                                                                                            SHA1:9C20DB16599E668A275850C5414FA7164D3CF24F
                                                                                                                            SHA-256:C0C7AB86A76C399B80795BA2B5DF138C3A25BC407EA4ED7FC1F0FA3341FA93BF
                                                                                                                            SHA-512:AF63B8AB19CDFC3BF041C559887ED3C2BAFFF1CDAA521D7B72F55077352F1E124C7933735EB7CC900088E158B72F253889AEF5DBCAC96A2A9B871F76603AB418
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................b.. .<......{...{...V.....<.i........m...k...l...n...o.......6.......g.g...g.h...g.i...g.f.....G.....5...&.G...6.A...&.A...6.....8.............A.....B...!.?...(.K...+.G.....>...8.>.........$.?.j.....B.(...$.?.0...$.G.0...$.L.$...*.L.7.....>.....$.>.8...........$.?.g...$.?.h...$.?.i.....?.....0.......0.5.?...6.(.?...8.+.....8.+.0...8.G.......>.2.....>.!.../.A...0.../.A...1.................>.0.....&.>.0.....,.>.(.....7.>.".....*.?.*...../.>.0.....2.A.2.....A.2.H...$.K.,.>...(.>.8.@...*.9.>.....,.>.,.>...8...>.3...8.G.(.G.....0...9.....>.(.G...'.M.5...........3.....K.9.....0...>.....0...>.,...H.-.m.m.../.B...8.../.B...G...9.>. .0...9.C.&./...-.>.&.M.0.......*.B.........6.?.0.....H.$.M.0...$.>...A.....$.?.6.0.@...$.G.5.G.$...&.A.*.>.0...(.?.8.>.(...*.>...(.>.....G.9.G.0...6.G.5.>.$...8.?.5.>.(...9.>.$.K.0...9.G.&.>.0.....0.0...9.....?.....B...9.>. ...A...9.>. .......9.>. .8.K.....8.*.B.......*.M.0.?.......M...K.......8.M.....!.?.8.G.........0.>.......K.9.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\mr_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ms_BN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):220
                                                                                                                            Entropy (8bit):4.5062548838343375
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvGfCllKtu1/tY+6oxf6224LyPqhUG/oX0FAQnUqN:jmQtu1D1f6sWPTG6GUqN
                                                                                                                            MD5:EDBCCF817D5DBD629FB8596125B49775
                                                                                                                            SHA1:56C2FF31B97882EBCDD4BF34050583826C5AE6B1
                                                                                                                            SHA-256:80B4FA07CF54225E5940E6C8D1F515302D8274960DA296C9B51A0C286DA23F69
                                                                                                                            SHA-512:0309D7659F088AAFDD9B8D2C90005734C13FE4F91F83568E62085C5BDC5D86D3A976E124A64031A8799F47CD38F25E2F3B05314B8250265D34E7CCAE1200A285
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................*.. ......../.../........................Y4......NN.....h.B7w.3DyEyy................h.B7w.3.yW*eh9........................P...P....... ....................`...".. $.. ....o.w. .. ...`&..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\mt.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9752
                                                                                                                            Entropy (8bit):5.445383449559793
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:RKLLE4z7cu7an+pzZv+2AaJONv1LqztvBaTMA9ZfqWiglBYy:RKLwK4DaF9BaoA9VqWNlBZ
                                                                                                                            MD5:14378C6F55EA8C017AE94A0CDA1CF27B
                                                                                                                            SHA1:B5C1240FCB923C80B2A3C113D396EFBB95F6A73D
                                                                                                                            SHA-256:57CDE9931598171C8EF4C48A1B2F0CE44A2798604FB27609D05D2CE19E5E42C6
                                                                                                                            SHA-512:F5B1F0EC83ACC5C69EA2D42068586CCC7021CBF0123E122D3A18F5138F5F48065A3CEAF4B42E6837BB2B867B3A01CB157D8B90E9C6AF04EFC0F6BE0A059E2496
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................h.. ........~...~...4.......B........ ...&.m...E.r...S.b...T.l... .m...&.d...A.p...A.w...D.....J.n...L.j...M.j...M.z...N.v...O.b...Q.K...S.t...T.n...W.K... .n...E.r.b...S.i.b...T.l.i...T.n.e... .i.m...&.a.d...&.a.m...Q.E.K...A.w.w...D.i.....F.r.a...L.u.l...M.e.j...O.t.t... .u.n...j.u.m...S.e.n.a...F.r.a.r...|.o.n.a...i.s.s.a...L.u.l.j.u...M.a.r.z.u...M.e.j.j.u...X.a.h.a.r... .u.n.j.u...[.c. .y.]...g.'.a.d.a...i.l.l.u.m...J.a.n.n.a.r...E.,. .M.-.d...A.w.w.i.s.s.u...I.l.-.&.a.d.d...I.s.-.S.i.b.t...O.t.t.u.b.r.u...M.e.t.r.i.k.u...l.b.i.e.r.a.'...s.e.k.o.n.d.a...D.i...e.m.b.r.u...I.l.-.&.a.m.i.s...L.-.E.r.b.g.'.a...N.o.v.e.m.b.r.u...Q.Q.Q.Q. .-. .y...{.0.}. .u. .{.1.}...1.e.l. .k.w.a.r.t...2.n.i. .k.w.a.r.t...3.e.t. .k.w.a.r.t...I.l.-. .i.m.g.'.a...I.t.-.T.l.i.e.t.a...S.e.t.t.e.m.b.r.u...s.i.e.g.'.a. .i.l.u...{.0.}.,. .u. .{.1.}...!.i.m.g.'.a. .i.l.u...4.b.a.. .k.w.a.r.t...m.i.n.u.t.a. .i.l.u...{.0.}. .&.d... .i.l.u...G.G.G.G.G. .M.M.M. .y...W.a.r.a. .K.r.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\mua_CM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\my.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14992
                                                                                                                            Entropy (8bit):5.553911380584789
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:rXWoOPKq0HdI+ukEs4nhyliMJoH2r9kx+GKiSxMMKQ3Wil4q:1Xi5QGil4q
                                                                                                                            MD5:3A86006F374C9039ABABF84626068173
                                                                                                                            SHA1:B5AE8DEA97D4F93EAAEF82A3EB5AE6AAB2AF625F
                                                                                                                            SHA-256:AFC117398E2508DC84F3F6F0766E10260DED0D16DB25F0F2594818E333E621B7
                                                                                                                            SHA-512:921A95FBAB345BEE995B6C240D0B98FB5B785875AC3B804006BC1925EFB72A598D46C44433D51BED52BB566957AA6BF8F661E241AADD4A34E8F110566D4D1985
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................V.......:....................!...'...).......................J.....1...!.......0.........../.....1.....0.......1.......:.......:.......:.....-./......./...!...,...!...6.....=...:...../...:...m.y.m.r...'...<.................../.........1.7.........6...!...=.2...!...1.....!.....:...!...-./.....6.....:...!.1.,...:...).../...:......./...:.......1.7.........:...;...!...<.,.8.....1.7.....:.....1.,...<.,...!...:.9...+...$...-.....:...B. .H.:.m.m...c.c.c...1.7...d./.M.J. .E...{.0.}.....:...../...1.0......./...1.0.......6...+...:.........:.9...,...$.....1...1.7...../.6...1...:.......0.../...1.....0...-./...:...........:...,...........!...8.......:...1.7.........0.....:.8.....;...:.8...6......./...>...:.....,.....7.:.....!...0.8...<./...!.../...:...,...!...6...;.,.8...!.,.8.....,.8...$.!...;.-...:.....<.,.......1.8...../...9.....0.8.......0.0.../...1.......0...1.,...-.......0...1.,...:.......:.....:...,.......:.....+.........-./.....:...,.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ne_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):132
                                                                                                                            Entropy (8bit):3.9393888834978372
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tldRMm/mlvlllKqOgrNIwn82CPcltslulflFpLbN:SvomOPSGZNn8XPcltVTFX
                                                                                                                            MD5:6B3B5860048F143CC20E0EEE13A769A1
                                                                                                                            SHA1:BABA416269B260485E9F11616E964A06AE015FBA
                                                                                                                            SHA-256:BAC0B64DA8D4B90EA48AFD8EA3FFC7ADD05964C6F595BFA08121B07B04B08C9B
                                                                                                                            SHA-512:C4D8E126DEA125D46EF614F344E6B475B1D3A1C5DD89C0E8A222202F474002676A1DD4CFC559DA0FB2E067D732110C1511E81B0106C804904423029DD994C050
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .E....................E.............h.B7w.3CwD...........................`.... ..o.w......`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\nfkc.nrm

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):53856
                                                                                                                            Entropy (8bit):5.901391108627108
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:10O6vxFTmBsncJOgSsCzH3rgrPF1upF7DJ03AHhPRjelRP:136vH0qcMgSswgF1u7iAHhPR6r
                                                                                                                            MD5:A45E58F36E178B29D487B4D23E53971A
                                                                                                                            SHA1:FDAC567626074D20C678DFC0F858C5F2E4402B99
                                                                                                                            SHA-256:BB31DD85424A3BA36C90FA7C0BFDFF5B63F91E94E0AA1CC3630A9AB1F8396532
                                                                                                                            SHA-512:CE59B53CFE57D586C77DBF0B5C53141E20E0A25D29DB6A6504E90B4A749989B7081A6D458277D40C3F50471548B75E23C4ADCE60AC8276D7AD9230ED7AA6BB5D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........Nrm2................P....i..4...4...4...4...4...4...............X)...g......R....`...e...g..........3irT..E.a-..+.~...@.{.....;.{.....+.Y.......Q.......M...+.+.....6.n.+.......+.1.o...+.....G.g.....".A.~.g.....$.+.^.u.......+.A.a.........U.......+.%.3.s.......+.+.+.+.+.(.+.+.+.+.+.+.+.+.+.+.+.+.+.+.T.+.+...+.+...+...+.+.+...-.m.+.......K.F.+.+.......2.r.....2.r.....2.r.....1.a.....!.T.......F.t.+.+.+.+.......+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.S.`.+...+.+.+.+.+...+...+...+.2.+.+.r.......R.......K.......K.+.......K.......K.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.+.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\nl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):29580
                                                                                                                            Entropy (8bit):6.01533807474763
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:elqnsK1s1dSE4kV/AE1GZ555xkKSqH9d8a:el1KCS6A555SU
                                                                                                                            MD5:AC2F4EC11C08420A951B944B29CE2429
                                                                                                                            SHA1:902078221B3223AB738835C6AF0D68465E34B5B7
                                                                                                                            SHA-256:FFA8D90455FEF85E98E8095B99011F9619FD00122682DEB4C22166563C564A78
                                                                                                                            SHA-512:6781DFD23CFB4B5361ADBBF192629E801370334D7458F7BDDFE683CC2EE5B7E6FBA4609B211D635B35FD52114415B2CDBA6E79F2E8D0E7F251BE072B4A0EF44E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................V................O.s...A.a.p...R.a.t...T.u.t...m.e.i...v.g.j...G.e.i.t...H.a.a.n...H.o.n.d...h.e.e.t...k.o.e.l...k.o.u.d...w.a.r.m...A.b.i.b...T.. e.r...S.j.a.....m.r.t.....d.i.e.r...h.a.r.t...n...C.....p.i.j.l...v...C.....v.l.a.g...D.r.a.a.k...P.a.a.r.d...S.l.a.n.g...B.a.b.a.h...T.u.b.a.h...e.r.a. .0...m.n.d. .1...m.n.d. .2...m.n.d. .3...m.n.d. .4...m.n.d. .5...m.n.d. .6...m.n.d. .7...m.n.d. .8...m.n.d. .9...a.v.o.n.d...M.o.e.h.....S.j.a.w.....e.r.a. .1...m.a.a.r.t...B.r.i.t.s...t.o.e.t.s...K.o.n.i.j.n...T.i.j.g.e.r...V.a.r.k.e.n...A.d.a.r. .A...A.d.a.r. .B...E.l.l.o.e.l...K.i.y.a.h.k...M.a.a.g.h.a...S.j.e.v.a.t...m.n.d. .1.0...m.n.d. .1.1...m.n.d. .1.2...S.j.a.w.a.l...v...g...j.....c.i.j.f.e.r...d.-.M.M. .U...g.e.b.o.u.w...n...C.h.r.....o.p.m.a.a.k...r.e.i.z.e.n...v...C.h.r.....B.a.. u.n.a.h...P.a.g.u.m...n...T.a.m.m.o.e.z...T.i.s.j.r.i.e...m.a.a.n.d. .1...m.a.a.n.d. .2...m.a.a.n.d. .3...m.a.a.n.d. .4...m.a.a.n.d. .5...m.a.a.n.d. .

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\nl_BE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):468
                                                                                                                            Entropy (8bit):5.158352410801337
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:KxXyBXyAy5f1xZWhlcXW+Qn1xZpRmLwMIW6hkdZ:IyRyAy5dxozK9Q1x3RmvIg
                                                                                                                            MD5:93AAE249BF77235A65969F2896B6F636
                                                                                                                            SHA1:7C8F3F9448A296137D88E6AE75508CF83C9ACE39
                                                                                                                            SHA-256:6F94707053552011B89FA20CC3E5DECD505683F864A28D4F4E4B95CC91789C08
                                                                                                                            SHA-512:28891A449C88B7EB01F97E6684C48AE8BFAB5F3A9094BD2A327D6A05C88215AD9A77E6190E514722DAA541CC8829AFB6697BF302BB1D42C37520BDED74BD9A21
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................i.. .f......m...m.........f.K........E. .d./.M.M./.y. .. .E. .d./.M.M./.y. .G.....k..)...4mhEy...\...F.F........!........5...\e......$.]o]o....$..6.6.......O.O....$...g.g.g.....$...........k..)...4.MW*eh.)...F.F........!..... ..5..N.'..4....$.]o]o....$..6.6..............$.............$....l.l.l......!..... .0..P5..P:..P?..PF..P......5.....%..PK.. ....!..... .f..Pk..Pp..Pu..P|..P......5.M...[..PX.. ....`...S.. `.. ..o.w......`e..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\nl_BQ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\no_NO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.6835941172605455
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlKelBjlgljl/wP5Fja7n:SBtkJTl4S2
                                                                                                                            MD5:1929DEFEE467163B0CD728B6D59F8CE0
                                                                                                                            SHA1:8B3D327517678CFC0819CD41B2DD788D7CE93B61
                                                                                                                            SHA-256:1F55FECE3C18E10D5A03074F9200546B0C6FC1701A80AB7ADFA7AE230F4DED4E
                                                                                                                            SHA-512:2A60AD62F64DE972EFADF999F431BD900A737ED6B1E270DBA214B53013EAFF2960AF4459EE7B4A16D73A90DCD3ECC291C66EBEFC42CD86E706E5316E32B22B32
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.................................n.b._.N.O.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\no_NO_NY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.6608668445332726
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlKelBjlgljl/wP5Rja7n:SBtkJTl4S6
                                                                                                                            MD5:73403BA652DA107A8E56986D72F5243B
                                                                                                                            SHA1:8AB3AF9BDC29BBF3058167DE4BE40FF02A5E6937
                                                                                                                            SHA-256:A1AC086A8942F081E82B5AE88CF3F69E501438B15E321733B21C0A5CC7ECC536
                                                                                                                            SHA-512:AEFC103FA6264783A2B2DB38A27A3A8A1578F8C0395F322EEC51B718EC21A2FF1316EC03C6998DBC9B623F38488645EBFCE2A032FBAE4A5A03B92E7EB99E0C43
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.................................n.n._.N.O.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\nyn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1232
                                                                                                                            Entropy (8bit):5.536271573364604
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:ng+tAIL3kZtYT7tqi/7t6j6TvMIe06TvMs4YT86zVJEVi:g+tp3otYdZ6+jMIerjMzYT3EVi
                                                                                                                            MD5:F3808D807307AAE69A1753E613D76A94
                                                                                                                            SHA1:EFD294AF4278290BF7D114FDDF2EF7FB1C05C37E
                                                                                                                            SHA-256:B2E5EFFE5DD7FFBFE9319FD40F632D058D718C4969C175D31B232F24967B07EF
                                                                                                                            SHA-512:466046BFBB246FBA5BD3B492E11995197F57FF4049FAE2343750C2A4249479C1D0C6A789CCB0D0D23145A078BF14050561FF6B123F5D124AED0F41A79A114BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................!.. .m......,...,.........m..........K.B.Z...K.K.N...K.M.K...K.M.N...K.M.S...K.M.W...K.N.B...K.N.K...K.S.T...K.T.N...O.K.B...O.K.N...O.K.S...O.K.T...O.R.K...S.A.N...S.a.n.d.e...E.s.a.n.d.e...S.h.a.a.h.a...E.i.z.o.o.b.a...K.W.O.T.A. .1...K.W.O.T.A. .2...K.W.O.T.A. .3...K.W.O.T.A. .4...O.b.u.n.a.k.u...E.r.i.z.o.o.b.a...O.k.w.a.k.a.n.a...O.r.w.a.k.a.n.a...E.s.h.a.a.h.a. .z.a........)..k..)...4.wEy..................................!.$...0.............'./..4....eN>...D....L...3..].N..).P.M.N......k..)...4.wW*eh................................!.$...0.............'./..4....eN>...D....L...3..].N..).P.M.N..................4=Y0.=...=(=..>.....>......4..j.R......}..n.1...r..v.~.z..M.......=80.<...<.<1I.<C0t%..l...G.A..4D..4G.G.D.>.J.../...^.a.d.g.............h.~.................H....<..<....Y.........................................<....................P....... ...............P........ ...(.......0.............. ... ........8...;...........>...K...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\om_ET.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\or.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14580
                                                                                                                            Entropy (8bit):5.68156160232456
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:XGw4vvkTeSuGT3pQsLB8vDyNjtXuBqMD/+:X+vvkTeSuGT3pQsLqv0tXuBDr+
                                                                                                                            MD5:C065C1817B5FD2811F2850C5298DAE7A
                                                                                                                            SHA1:CF3F70C18690ADE405BB3B4F815E7E24E19A686E
                                                                                                                            SHA-256:F5111C749FD7D610A60E22D900D445DCBB19CC2BADAABB06786B0C98EB421441
                                                                                                                            SHA-512:BA6FB105D83A50E549524200E6AD64D8F7C46E9BDE55AFC186ACAC7AD6FE1AA46099C3D0FDC8B55CAD8B85ACF50C54740CA77324BD29CDD007F3013E5F52B331
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........5...5...V....................6...........A.....A.........!.?...+.G...,.....,.A.....>...8.G.........*.B...8.K.......A.(...0.,.?...6.(.?.....0.9...*.6.A.....?.........?...8.G.......A.0.A.....0.0.9.....0.(.?.....0.,.?...o.r.y.a.......M.......(.M._...6.0.@.0...9.C.&._..._.A...G.......7.M.......A.2.>.........M...3...6.A...M.0.....0.0.0.9.....0.0.(.?.....0.0.,.?...$.M.0._.........K...?.....$. .8.K...*.$.>...>...*.A.0.A.7...,.?.,.?.'.....9.?.3.>.../.K.!.<.>.....*.M.0.G.2.....0.0.0.(.?.....0.0.0.,.?.....0...M.0.?.....9.?. .8.K...9.>...M...>.....>...M...?.....$. .,.A.'.....$. ...>.8.....$...>.2.?...*.&.>.0.M.%...,.M.0.G.2.M.../.>.$.M.0.>...8...6.K.'....._.A...8.M.. ......M...K.,.0.....>.(.A...0.@...(.-.G...M.,.0...+.G.,.C...0.@.....>.0.M...M.......0.0...M.0.?.....9.?. .,.A.'.....$. .0.,.?.......$. .6.(.?.....{.0.}. .&.?.(.....9.?. ...>.8.....M.0.@.!.<.>.....$. .,.0.M.7.....$. .,.A.'.......$. .8.K.......*.>.#.?.*.>.....8.M...>...2.?...0.0.0. .9...>.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\or_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\pa.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17376
                                                                                                                            Entropy (8bit):5.864006114762211
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:2uZ0sDRJM4RfEfzbfYPEDLquOn9wFPOU19bxvrcfi2F4ghuuQNxm4BYx7y755nL5:2w0IRJ5ERWub9Ii2FvhuuQNc4BG7YqMN
                                                                                                                            MD5:3955A45BD6CD23FBBB5E84843E3B680E
                                                                                                                            SHA1:50CA52EDA3A8C758526D25E0FB6A140E13952AB1
                                                                                                                            SHA-256:D940D24BC363B18733F4A5FC68DDD96BBCCF765704DB01B75A714F44E20DE93C
                                                                                                                            SHA-512:CC0D7F7D0902E6A04BD26A76E959A37B4D6AFF01B77500ECD03E49442DA0A3ADBAA1A9E978965D3ED396B5CDBD3592543CFA05540D1682C8F58FF22316448003
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................V....................i...j...k...l...m...n...o.....5.........g.g...g.h...........(.....A.....B...+.<.....>.....p...5.@...8.K...g.f.....p...!.G.......&.0.....q.......G.$.....B.(.....G. .....?.0...*.K.9.....>.....8.@.(...9.>.\...9.A.#...&.8.p...(.5.p...+.<.0...,.A.q.....p.....0...,...8.$.p...8.+.....8.+.0.....p.......0.$.....G.!...&.?.2...8.<.....9.K.0...9.G...0.....>.2.0.....>.2.1......./.0.....*.H.*.....,.>.(.....q.8.B.....2.A.2.....@.........q.$.......G.5.......K.......$.K.,.>...+.q...#...,.>.,.>.....>.0.......G.9.0.....q...0...8.>...#...9...2.G...9.H.!.0...-.2...G.....?.p.....8.>...>...8.p...$.......$.B.......8.$.....A.2.>...0.>.......0.>.......8.<.......8.<.>.....g.u.r.u.....p.!.>.....p.!.G...*.L.&.>...,.#.$.0.....L.8.....5.?.q.%...8.0.@.0...8.<.>.....8.5.G.0.G...0.>.$.@.........<.>.0.....&.0. .I.....8.+.p.!.....K.!.0.!...$.>.9.8.8...(.?.8.>.(...(.G...<.@...*.>...(.>...,.>.9...(...-.>.&.K.......H.8.0.>...5.H.8.>.....8.<.G.5.....8.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\pa_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.870450165586334
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/6nEoMx/E3:SBtkJYlU8g8l/f5Z4
                                                                                                                            MD5:4F503FC7E15796F5859820FFD974D465
                                                                                                                            SHA1:B9BEFED1CD772E3A79A6061C80CFB8E20F197950
                                                                                                                            SHA-256:AD2AAAD02567047B612355694D4CD372D941465E69343D2455EAB6BBE5F2C75A
                                                                                                                            SHA-512:19864CB9B1845E94008FD3D0D21F486BA9F64BF99A3E7B53AFB2048105D97E796217BBF416D09EDAADD88F92B2CC95E6787D54BEF7D4D8C917CF2B70480BC20B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.................................p.a._.G.u.r.u._.I.N...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ps.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9048
                                                                                                                            Entropy (8bit):5.9844525393082115
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:LPsb7j7bKfIHLPLsXYmDOcr9vALALr4bxnxxND0CZ8H:L4z+gxhLAL6f+
                                                                                                                            MD5:4380FEB3B2EB10293C94823E470BAAB2
                                                                                                                            SHA1:CF1090D3504DA519805DC5A13A4227D9CF0B4E66
                                                                                                                            SHA-256:4D70C5C2D9373474A07D279F6A91036962A13B5AE64C808C30A68899F31E5854
                                                                                                                            SHA-512:AA14EFE80C74FE8E35861BAF03F61035A757F2FFD6892940FCB9810BDFB33FF1804E3D0D9D9FE1FB70C60DA47B72190CAF2CD655CC4C4C60F481203671A11B43
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................V...............E.......(...D...E...*.D.G...H.......~...1...2...G...9...~.....J.2...:...E...../.H.F.....:...H.....J.H.F.....1.(.J.9...2.E.1.....:.H.......E...G.'...5.A.1.G...(.J.1.:...,.H...G...D.H.(.G...F.(.'.*...H.,.H./.....F.(.F.../.1...F.......D.1.F.....,.E.'.9.G...,.F.H.1.J...1.'.,.'.(...D...F./.....~.'.H.3.'.....F...'.......J.*.1.'...+.'.F.J.G.../.B.J.B.G...E.J.'.4.*...*.F.B.J.7...4.E...1.....E...|.1.....H./.'.F.......'.1.H.......F...(.*.......J.F.G.........'.~...H.J.3.'...'...~.J.F...F.....'.3.'./.G.'...'.3.H.J.F.'...(.G.'./.1.'...,.J.'.3.*.'...3.D.H.'.:.G...E.1.:.H.E.....(.D. ...'.D...A.(.1.H.1.J...'...E.H.,.....A.9.'.D.J.*...E.*.A.1.B.G...F.'.1...F.G.....'.1.*.J...'...-.D.'.D. .-.,...1.(.J.9. .I.I...3.1.'.H.'.F.'...:.(.1...H.D.....3...~.*.E.(.1...(./.D.H.H.F.....(.1.J.*.'.F.J...(.J.1.:.H.F.G...:... .,.'.E.H...A...(.1.H.1.J...E.3...../.D.....|.H.F. .F...G...~.1.H.3.....'.D...,.E.H.E.'. .I.I.../.'.D.B.'.9./.G...~.G.'.D...H.F.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\pt_LU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1470892603744245
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllpxlRhstP9hGn:SvMMZhstWn
                                                                                                                            MD5:1EBD2CF7B1B1688EDBA5E6481651878D
                                                                                                                            SHA1:D7475C1E2105A5316F89BAD639102A22E59E8206
                                                                                                                            SHA-256:8840ADEBC3ABC62843F8E6350F2E28528A3CA15D65FA9979BED3BF44566867A9
                                                                                                                            SHA-512:208EF55200983034D2E782B061C3C065E60832CB443D5B4CFDBE9297D338E9867089B7F26FD2A7BD7C25BDD11E8B5C7C7BDAA77A409DC679A931256CA038AA0A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\pt_MZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1470892603744245
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllpxlRhstP9hGn:SvMMZhstWn
                                                                                                                            MD5:1EBD2CF7B1B1688EDBA5E6481651878D
                                                                                                                            SHA1:D7475C1E2105A5316F89BAD639102A22E59E8206
                                                                                                                            SHA-256:8840ADEBC3ABC62843F8E6350F2E28528A3CA15D65FA9979BED3BF44566867A9
                                                                                                                            SHA-512:208EF55200983034D2E782B061C3C065E60832CB443D5B4CFDBE9297D338E9867089B7F26FD2A7BD7C25BDD11E8B5C7C7BDAA77A409DC679A931256CA038AA0A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.....................................o.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\qu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):7612
                                                                                                                            Entropy (8bit):5.700235005775752
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:zbdt8C1Y3QjaFpJF2YYyiiKWkqtWEfYCg6c:5n6tiiQ5gc
                                                                                                                            MD5:2E275A6E4C3F7184E8D9D6DC8B097126
                                                                                                                            SHA1:A23F12E961EDB0A6DA20B54000013F173BE04E77
                                                                                                                            SHA-256:BE06000773B6585D1419BEDB574471BDB18A9C34E71AB90A23BD19FFE12D992B
                                                                                                                            SHA-512:599F2AB9D93E01254820DACA7E73E7F69F64664F437009792A14AA73A44141311F58384F9AD85A72007D2F68A40A38384522CD59F5DE8EFB9556B1EB68077927
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................Y.. ........g...g...B.......Y........X...d.C...D.o.m...J.u.e...M.i.....V.i.e...D.a.y...D.i.c...E.n.e...p.a.q.a.r.i.n...k.a.y. .h.o.r.a...-.{.0.}. .L.u.n.e.s...+.{.0.}. .L.u.n.e.s...d. .M.M.M. .y.,. .G...h.a.m.u.q. .w.a.t.a...k.a.y. .m.i.n.u.t.o...k.u.n.a.n. .w.a.t.a...q.a.y.n.a. .w.a.t.a...-.{.0.}. .J.u.e.v.e.s...-.{.0.}. .S...b.a.d.o...+.{.0.}. .J.u.e.v.e.s...+.{.0.}. .M.a.r.t.e.s...+.{.0.}. .S...b.a.d.o...k.u.n.a.n. .L.u.n.e.s...q.a.y.n.a. .L.u.n.e.s...h.a.m.u.q. .L.u.n.e.s...h.a.m.u.q. .k.i.l.l.a...k.u.n.a.n. .k.i.l.l.a...q.a.y.n.a. .k.i.l.l.a...-.{.0.}. .V.i.e.r.n.e.s...+.{.0.}. .V.i.e.r.n.e.s...h.a.m.u.q. .J.u.e.v.e.s...h.a.m.u.q. .M.a.r.t.e.s...k.u.n.a.n. .J.u.e.v.e.s...k.u.n.a.n. .M.a.r.t.e.s...k.u.n.a.n. .S...b.a.d.o...q.a.y.n.a. .J.u.e.v.e.s...q.a.y.n.a. .M.a.r.t.e.s...q.a.y.n.a. .S...b.a.d.o...{.0.}. .s.e.m.a.n.a.p.i...h.a.m.u.q. .S...b.a.d.o...h.a.m.u.q. .s.e.m.a.n.a...k.u.n.a.n. .s.e.m.a.n.a...q.a.y.n.a. .s.e.m.a.n.a...Q.a.y.n.a. .V.i.e.r.n.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\az.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3268
                                                                                                                            Entropy (8bit):3.8070835658396462
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:oBBEoHtfyqAVT9WMiJeyJ7ujPWGiKtPcJrXvt3b7YAL2vgRgdvuPvzFM:3Tkes7ujHiKFyrftb7YAL2vmgdvuPvzW
                                                                                                                            MD5:F4ED2F0F2F560E5046FE21A76FBF40B6
                                                                                                                            SHA1:B4DA66DE402E51CD583A15F13362C474571F0E03
                                                                                                                            SHA-256:AA960E0A87480B4D9579C92DC41667A4E31FC3D723213318C260D9DDB3BCD4B2
                                                                                                                            SHA-512:897E665B9C6109465103363DFFB3B75809021B199E876E1000C3BCBFB487FDD5ECE78F5300DF05DB5B8BCD35974CFFF45C37AF74AA5896F0DCA61FD998F096CE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................%.. ........)...)...........!...RBNFRules.OrdinalRules.SpelloutRules.Version......%.%.n.c.i.:...3.:. .....;...%.%.i.n.c.i.:...%.%.u.n.c.u.:...0.:. .n.c.i.;...1.:. .b.i.r.;...2.:. .i.k.i.;...5.:. .b.e._.;...%.%.i.n.c.i.2.:...%.%.u.n.c.u.2.:...-.x.:. ..">.>.;...0.:. .i.n.c.i.;...0.:. .u.n.c.u.;...0.:. ...n.c...;...0.:. .1.n.c.1.;...4.:. .d...r.d.;...6.:. .a.l.t.1.;...0.:. .s.1.f.1.r.;...2...1...2.7...2.2...7.:. .y.e.d.d.i.;...0.:. .'.'.i.n.c.i.;...2.:. .i.k.i.n.c.i.;...3.:. .......n.c...;...8.:. .s.Y.k.k.i.z.;...9.:. .d.o.q.q.u.z.;...1.:. .b.i.r.i.n.c.i.;...5.:. .b.e._.i.n.c.i.;...6.:. .a.l.t.1.n.c.1.;...x...x.:. .=.0...0.=.;...-.x.:. .Y.k.s.i. .>.>.;...1.0.:. .o.n.[. .>.>.].;...4.:. .d...r.d...n.c...;...7.:. .y.e.d.d.i.n.c.i.;...0.:. .s.1.f.1.r.1.n.c.1.;...3.0.:. .o.t.u.z.[. .>.>.].;...4.0.:. .q.1.r.x.[. .>.>.].;...5.0.:. .Y.l.l.i.[. .>.>.].;...8.:. .s.Y.k.k.i.z.i.n.c.i.;...9.:. .d.o.q.q.u.z.u.n.c.u.;...1.0.:. .o.n.>.%.%.u.n.c.u.>.;...6.0.:. .a.t.m.1._.[.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\bg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3404
                                                                                                                            Entropy (8bit):4.172777423011433
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:1S3KmPaJNJr0JcJu9FkjMnf8h4+jUcHkf:ZVTrKyu9FkjMnf8h4+jUcE
                                                                                                                            MD5:B946D84B7788775B2855FF429F4E926C
                                                                                                                            SHA1:ECF92DE49FB7F11ABDFF145DA8DFB112E89E5701
                                                                                                                            SHA-256:7B2233BD1C7041175A672CFC3766AECC8A5DF2432F4500EE41B5D526E55A1CC7
                                                                                                                            SHA-512:401E245FB1F713F5BB9AF849339A4AF137D706847B1BA22842B2C0D375EA80E748BA1216FFDB08C12EE53580AF66A3FE50059124A18729C23E35ED45F8A7E35D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................G.. ........K...K...........E...RBNFRules.SpelloutRules.Version...2.:. .4.2.0.;...2.:. .4.2.5.;...3.:. .B.@.8.;...5.:. .?.5.B.;...0.:. .=.C.;.0.;...1.:. .5.4.8.=.;...1.:. .5.4.=.>.;...6.:. .H.5.A.B.;...8.:. .>.A.5.<.;...2...1...2.7...2.2...7.:. .A.5.4.5.<.;...9.:. .4.5.2.5.B.;...1.0.:. .4.5.A.5.B.;...4.:. .G.5.B.8.@.8.;...x...x.:. .=.0...0.=.;...-.x.:. .<.8.=.C.A. .>.>.;...1.0.0.:. .A.B.>.[. .>.>.].;...1.1.:. .5.4.8.=.0.4.5.A.5.B.;...1.2.:. .4.2.0.=.0.4.5.A.5.B.;...1.3.:. .B.@.8.=.0.4.5.A.5.B.;...1.5.:. .?.5.B.=.0.4.5.A.5.B.;...x...x.:. .<.<. .:.>.<.0. .>.>.;...%.%.l.e.n.i.e.n.t.-.p.a.r.s.e.:...1.6.:. .H.5.A.B.=.0.4.5.A.5.B.;...1.8.:. .>.A.5.<.=.0.4.5.A.5.B.;...2.0.0.:. .4.2.5.A.B.0.[. .>.>.].;...3.0.0.:. .B.@.8.A.B.0.[. .>.>.].;...1.7.:. .A.5.4.5.<.=.0.4.5.A.5.B.;...1.9.:. .4.5.2.5.B.=.0.4.5.A.5.B.;...1.0.0.0.:. .E.8.;.O.4.0.[. .>.>.].;...1.4.:. .G.5.B.8.@.8.=.0.4.5.A.5.B.;...2.0.:. .4.2.0.4.5.A.5.B.[. .8. .>.>.].;...3.0.:. .B.@.8.4.5.A.5.B.[. .8. .>.>.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\bs.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2724
                                                                                                                            Entropy (8bit):3.8125465320367646
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:W2aPeNfBSfxkhrHNpVMnRzklEfOcTJmPm58mdJjRXExJVSfRbQuM1uMxg4WFLsdN:UPeWsTedJur0JjRqJVSfRMuuuKg4WmP
                                                                                                                            MD5:821396B7A9D6576E8990CE5BD73F877D
                                                                                                                            SHA1:3ABFF51745D30E34FDFBF962A996C9471D9C6C78
                                                                                                                            SHA-256:DAD4F85C45A47C1C5A79A71E297EB80DA2F08A1E6D61DF3E372F8056AAC86943
                                                                                                                            SHA-512:75500CFCF13A4A55F08C327E972AA292108A6C27B7CA5EDCFEE4E4D16835A522FA290B6F05749B46D13D12B41E0DD28AC3D3201D3C08EE53CC746EA6427526C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................RBNFRules.SpelloutRules.Version...2.:. .d.v.a.;...2.:. .d.v.e.;...3.:. .t.r.i.;...5.:. .p.e.t.;...0.:. .n.u.l.a.;...6.:. .a.e.s.t.;...8.:. .o.s.a.m.;...1.:. .j.e.d.a.n.;...1.:. .j.e.d.n.o.;...2...1...2.7...2.2...7.:. .s.e.d.a.m.;...9.:. .d.e.v.e.t.;...1.0.:. .d.e.s.e.t.;...4.:. ...e.t.i.r.i.;...x...x.:. .=.0...0.=.;...1.:. .j.e.d.i.n.i.c.a.;...-.x.:. .m.i.n.u.s. .>.>.;...1.2.:. .d.v.a.n.a.e.s.t.;...1.3.:. .t.r.i.n.a.e.s.t.;...1.5.:. .p.e.t.n.a.e.s.t.;...1.0.0.:. .s.t.o.[. .>.>.].;...1.1.:. .j.e.d.e.n.a.e.s.t.;...1.4.:. ...e.t.r.n.a.e.s.t.;...1.6.:. .a.e.s.t.n.a.e.s.t.;...1.8.:. .o.s.a.m.n.a.e.s.t.;...1.7.:. .s.e.d.a.m.n.a.e.s.t.;...1.9.:. .d.e.v.e.t.n.a.e.s.t.;...6.0.0.:. .a.e.s.t.o.[. .>.>.].;...2.0.0.:. .d.v.e.s.t.a.[. .>.>.].;...3.0.0.:. .t.r.i.s.t.a.[. .>.>.].;...5.0.0.:. .p.e.t.s.t.o.[. .>.>.].;...5.0.:. .p.e.d.e.s.e.t.[. .>.>.].;...x...x.:. .<.<. .z.a.r.e.z. .>.>.;...2.0.:. .d.v.a.d.e.s.e.t.[. .>.>.].;...3.0.:. .t.r.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\da.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8256
                                                                                                                            Entropy (8bit):3.6514733298145963
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:MORhOM+Zr8qMa9bdTccODcImjrzUfB7eeeperKGL5sLQHoCA3M8P2+F9vQFFdsYA:MORhOM+Zr8qMa9bdTccODcImjrzUfB7W
                                                                                                                            MD5:CC029FAF0B35257C9BC280F6C49E5AAF
                                                                                                                            SHA1:6E0DC67FB2C8AF385D57AC643B9E5F28407DD149
                                                                                                                            SHA-256:323F889FD6976D0D64A659218BA951ADB53348BF8323794990708E15F055467C
                                                                                                                            SHA-512:415BFD4E3497EFD23752DA9B6E5D1FEC40770C721A851BC0ADB196393DBAE03BC50C1428DA6896041618FDF89108DDF8B38C6AF7227CF41E27E9E81ED52CE838
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................RBNFRules.SpelloutRules.Version...0.:. .e.;...0.:. .t.e.;...0.:. .d.e.;...1.:. .e.n.;...1.:. .e.t.;...2.:. .t.o.;...9.:. .n.i.;...0.:. .n.u.l.;...1.0.:. .t.i.;...3.:. .t.r.e.;...5.:. .f.e.m.;...7.:. .s.y.v.;...4.:. .f.i.r.e.;...6.:. .s.e.k.s.;...8.:. .o.t.t.e.;...0.:. .n.u.l.t.e.;...1.2.:. .t.o.l.v.;...2...1...2.7...2.2...2.:. .a.n.d.e.n.;...2.:. .a.n.d.e.t.;...5.:. .f.e.m.t.e.;...1.:. .f...r.s.t.e.;...%.%.o.r.d.-.e.-.c.:...%.%.o.r.d.-.e.-.n.:...1.8.:. .a.t.t.e.n.;...3.:. .t.r.e.d.j.e.;...4.:. .f.j.e.r.d.e.;...6.:. .s.j.e.t.t.e.;...9.:. .n.i.e.n.d.e.;...%.%.o.r.d.-.d.e.-.c.:...%.%.o.r.d.-.d.e.-.n.:...%.%.o.r.d.-.t.e.-.c.:...%.%.o.r.d.-.t.e.-.n.:...1.0.:. .t.i.e.n.d.e.;...1.1.:. .e.l.l.e.v.e.;...1.2.:. .t.o.l.v.t.e.;...1.5.:. .f.e.m.t.e.n.;...1.7.:. .s.y.t.t.e.n.;...1.9.:. .n.i.t.t.e.n.;...7.:. .s.y.v.e.n.d.e.;...8.:. .o.t.t.e.n.d.e.;...x...x.:. .=.0...0.=.;...%.%.a.n.d.-.s.m.a.l.l.:...1.1.:. .e.l.l.e.v.t.e.;...1.3.:. .t.r.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\en_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):7840
                                                                                                                            Entropy (8bit):3.77137862592975
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:Yft6G3tYGp4JLGL3dQEU8w3uW5xoQ7zqS1tkMLK/yRJSfCvuJIrqFErV4HMCiHR0:6xnp4JLGLNQEU8w3uW5xoQ7zqS1tkMLY
                                                                                                                            MD5:F96736364A1510705D95E38827ADE063
                                                                                                                            SHA1:CFF0A353A2A86D60A1990A59565D63B5A0D87949
                                                                                                                            SHA-256:03DD1121F14C7CBCCA3D474A309A34BEE7776FACD2DB746A28B26EFC8A48B8B6
                                                                                                                            SHA-512:004CB0E1BFF063C34641AE604B13650B1B6D891507ADE42793249DE7AB8B1D694A5471C14FEA57D834DA56DEDC9CA2D8B8525D5BB3629DE90C39B50776382755
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................%%Parent.RBNFRules.OrdinalRules.SpelloutRules.Version.....%.%.t.h.:...0.:. .t.h.;...%.%.a.n.d.:...e.n._.0.0.1...1.:. .o.n.e.;...2.:. .t.w.o.;...6.:. .s.i.x.;...%.%.a.n.d.-.o.:...%.%.t.i.e.t.h.:...-.x.:. ..">.>.;...0.:. .z.e.r.o.;...1.0.:. .t.e.n.;...4.:. .f.o.u.r.;...5.:. .f.i.v.e.;...9.:. .n.i.n.e.;...%.%.c.o.m.m.a.s.:...0.:. .t.i.e.t.h.;...1.:. .f.i.r.s.t.;...2...1...3.5...1.3...3.:. .t.h.i.r.d.;...3.:. .t.h.r.e.e.;...5.:. .f.i.f.t.h.;...6.:. .s.i.x.t.h.;...7.:. .s.e.v.e.n.;...8.:. .e.i.g.h.t.;...9.:. .n.i.n.t.h.;...%.%.2.d.-.y.e.a.r.:...0.:. .z.e.r.o.t.h.;...1.0.:. .t.e.n.t.h.;...2.:. .s.e.c.o.n.d.;...4.:. .f.o.u.r.t.h.;...8.:. .e.i.g.h.t.h.;...%.%.c.o.m.m.a.s.-.o.:...0.:. .h.u.n.d.r.e.d.;...1.1.:. .e.l.e.v.e.n.;...1.2.:. .t.w.e.l.v.e.;...7.:. .s.e.v.e.n.t.h.;...1.2.:. .t.w.e.l.f.t.h.;...1.5.:. .f.i.f.t.e.e.n.;...1.6.:. .s.i.x.t.e.e.n.;...-.x.:. .m.i.n.u.s. .>.>.;...1.1.:. .e.l.e.v.e.n.t.h.;...1.3.:. .t.h.i.r.t.e.e.n.;.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\es.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8456
                                                                                                                            Entropy (8bit):3.8624830970369954
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:YL/zBbubZbRKE/zV7Ksr7fSNqCLenaWdmdQhQ7vN/0ReR+U:Y/zQ9bvZlr7fSNqCLenddCQhQ7l/0ReV
                                                                                                                            MD5:7939D34D047E6C7161E1BF695112964E
                                                                                                                            SHA1:B5AB319C696A3847E91970D98B1ACCB9C3D16802
                                                                                                                            SHA-256:6E42D0A53C0B2BA3F236D6AD4BAD59358DB36677142AE38ABAE39C13EB383E76
                                                                                                                            SHA-512:E731C9889510311A3F97EAE82A1606E56581F02255E1EC6A138AB445062A4D4CBD75E206B31E0E9C005202CD2BF9E2D917274AB10CD93E4123CD1379D7FAF4D4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................6.. ........:...:...........2...RBNFRules.OrdinalRules.SpelloutRules.Version......0.:. ...;...2.:. ...;...4.:. ...;...1.:. .u.n.;...1.:. .I...;...3.:. .I...;...1.:. .u.n.a.;...1.:. .u.n.o.;...2.0.:. .>.>.;...2.:. .d.o.s.;...0.:. .c.e.r.o.;...-.x.:. ..">.>.;...1.0.0.:. .>.>.;...3.:. .t.r.e.s.;...6.:. .s.e.i.s.;...8.:. .o.c.h.o.;...6.:. .s.e.x.t.o.;...1.0.:. .d.i.e.z.;...1.1.:. .o.n.c.e.;...1.2.:. .d.o.c.e.;...2...1...2.7...3.3...5.:. .c.i.n.c.o.;...6.:. .s.e.x.t.a.;...7.:. .s.i.e.t.e.;...9.:. .n.u.e.v.e.;...1.0.0.:. .c.i.e.n.;...4.:. .c.u.a.r.t.o.;...5.:. .q.u.i.n.t.o.;...8.:. .o.c.t.a.v.o.;...9.:. .n.o.v.e.n.o.;...1.3.:. .t.r.e.c.e.;...1.:. .p.r.i.m.e.r.;...3.:. .t.e.r.c.e.r.;...4.:. .c.u.a.r.t.a.;...4.:. .c.u.a.t.r.o.;...5.:. .q.u.i.n.t.a.;...8.:. .o.c.t.a.v.a.;...9.:. .n.o.v.e.n.a.;...1.0.:. .d...c.i.m.o.;...2.:. .s.e.g.u.n.d.o.;...7.:. .s...p.t.i.m.o.;...1.0.:. .d...c.i.m.a.;...1.5.:. .q.u.i.n.c.e.;...1.:. .p.r.i.m.e.r.a.;...1.:. .p.r.i.m.e.r.o.;...2.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\es_HN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):96
                                                                                                                            Entropy (8bit):2.767068904684046
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlF12PllvlsltloBk6lY0kEPn:SBtkJuelXo1lzn
                                                                                                                            MD5:01AC728B63D66869B5A2D94A2F88B64F
                                                                                                                            SHA1:E12801ED14CB0B7BB6252A3666C9C97820F15EE9
                                                                                                                            SHA-256:59A741F29DB4FD6792C6B24842F42AA8F9EF4E61C3F9085FDE8B92F29C76960C
                                                                                                                            SHA-512:132080285A86E399D3F920F470FAFCF39AC76D5370A492BEC00AF161C2C537E8368335F675E006B2EE64F6FFB02A78423A4BC7BB636342C5B92F13F4AB4C3E39
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...e.s._.4.1.9..... .....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\he.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10236
                                                                                                                            Entropy (8bit):4.30288241120569
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:ryWMULPyUSwVx8gV+mx8H24NTp73TKyjxIsxov9W5xpdwNisjtsbAsctUcwgXAwM:PLRVx8gV+mxM24NTp7Tpk9W5xHwNgAs3
                                                                                                                            MD5:197500A0C869F3CA04F2D1C865B8E282
                                                                                                                            SHA1:556662FF748B61695076EDE9EA7AA4C06206C460
                                                                                                                            SHA-256:C01C8336FA3F17895628B80D52C67195B68630DDA8233B870BAFB1F0D1B1387F
                                                                                                                            SHA-512:C41C105D853D40C722961BA0C32411162516A25B68CD49DA7E1393266D77B6C73F05BBE29823FDB70D1779EAD7D447179F8BC50342F6A0209E7F36EE1453D737
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................RBNFRules.SpelloutRules.Version...6.:. .....;...0.:. .......;...1.:. .......;...2.:. .......;...2.:. .......;...1.:. .......;...5.:. .......;...6.:. .......;...7.:. .......;...9.:. .......;...6.:. .........;...7.:. .........;...9.:. .........;...1.0.:. .......;...2.:. .........;...3.:. .........;...4.:. .........;...5.:. .........;...6.:. .........;...7.:. .........;...9.:. .........;...8.:. ...........;...1.0.0.:. .......;...1.0.:. .........;...2.:. ...........;...3.:. ...........;...4.:. ...........;...5.:. ...........;...8.:. ...........;...1.0.:. .........;...1.:. ...........;...2...1...3.8...3.4...2.:. ...........;...3.:. ...........;...3.:. ...........;...4.:. ...........;...4.:. ...........;...5.:. ...........;...6.:. ...........;...7.:. ...........;...8.:. ...........;...9.:. ...........;...2.0.:. ...........;...6.0.:. ...........;...7.0.:. ...........;...9.0.:. ...........;...1.0.:. ...........;...1.:. ...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\in.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.64671783887604
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlW/lRl/jlklbl+/+GPn:SBtkJGtaDYn
                                                                                                                            MD5:10B328EA87427AC0A91DB7AD5D9043DC
                                                                                                                            SHA1:34ECD90BE5FFB01A9DF4AFB11DD68D3E6353C709
                                                                                                                            SHA-256:137192AB9E551B5215DBE7072638AD3EC74B6B3591BED05665D6243FDAB63AEE
                                                                                                                            SHA-512:25C99AD2F4157C7C08430322CD2821FDF1E8CA3DCE8474FC9A2038F690BBC58E09A1E26AB594DD8FCF5BA87548BD3371911E60E6C879D1C7E981517A22E98D4C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...i.d..... .....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\kl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3072
                                                                                                                            Entropy (8bit):3.6206983228534515
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:erYXR/SrQIHRsR2YfmB65iJHJxR0K0i3q12f25kxfcJrVBS2V4C+BY4avakxmG8I:x/qenfeJHJ30KK+NxfcJruCE+ZpPDf
                                                                                                                            MD5:B9773C5EA3C7968F4F48C0BF6120E929
                                                                                                                            SHA1:1D0E7A8019FDF1FFC29A5424A1D31F82988A5299
                                                                                                                            SHA-256:BFA24A298DD628CA101B298A52AF55C72F37B345AAFC7F7720583B1F3A848D08
                                                                                                                            SHA-512:52D2D55CAD82BBBE9511573C13102EFE63253D2ADE2CE1BAF2D60CFCD48C21B5B3C9D5EF2F30EC7348AABAD2FB5EDC5E5245FF3A2EAE3606DFEF9AD8A9CE6677
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................RBNFRules.SpelloutRules.Version...0.:. .n.u.u.l.u.;...2...1...2.7...2.2...1.0.:. .q.u.l.i.t.;...2.:. .m.a.r.l.u.k.;...1.:. .a.t.a.a.s.e.q.;...4.:. .s.i.s.a.m.a.t.;...x...x.:. .=.0...0.=.;...1.0.:. .q.u.l.i.n.i.k.;...3.:. .p.i.n.g.a.s.u.t.;...5.:. .t.a.l.l.i.m.a.t.;...-.x.:. .m.i.n.u.s. .>.>.;...2.:. .m.a.r.l.u.n.n.i.k.;...4.:. .s.i.s.a.m.a.n.i.k.;...%.%.n.u.m.b.e.r.t.i.m.e.s.:...1.1.:. .a.q.q.a.n.i.l.i.t.;...3.:. .p.i.n.g.a.s.u.n.i.k.;...5.:. .t.a.l.l.i.m.a.n.i.k.;...6.:. .a.r.f.i.n.i.l.l.i.t.;...1.1.:. .a.q.q.a.n.i.l.i.n.i.k.;...6.:. .a.r.f.i.n.i.l.i.n.n.i.k.;...x...x.:. .<.<. .k.o.m.m.a. .>.>.;...1.6.:. .a.r.f.e.r.s.a.n.i.l.l.i.t.;...7.:. .a.r.f.i.n.e.q.-.m.a.r.l.u.k.;...1.0.0.:. .u.u.t.r.i.t.i.t.[. .>.>.].;...%.s.p.e.l.l.o.u.t.-.c.a.r.d.i.n.a.l.:...1.2.:. .a.q.q.a.n.e.q.-.m.a.r.l.u.k.;...9.:. .a.r.f.i.n.e.q.-.s.i.s.a.m.a.t.;...%.s.p.e.l.l.o.u.t.-.n.u.m.b.e.r.i.n.g.:...1.4.:. .a.q.q.a.n.e.q.-.s.i.s.a.m.a.t.;...1.6.:. .a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\km.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1608
                                                                                                                            Entropy (8bit):4.351115188008445
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:WE2SFlNz9zEij/0VZcWftJQh2M5JmvVOaEYmdJm59aoX8ffIp8E:HFlNz/SiWftJQh2CJ+VO+0JqaDIpF
                                                                                                                            MD5:5C4C33E736544B8000AB3E420CE0760E
                                                                                                                            SHA1:DDC214898D46CD2A61BC52E514C035AD75ED115D
                                                                                                                            SHA-256:4866ADDBB0F027D694567820AA80387B2F8D73AD4A2A97625DD7816D3202A2F3
                                                                                                                            SHA-512:D8844DCC8A74FFC65149B674774EDAF5B6256BC1EA8A6FCFB09648F693316E16F93C5F55CFABBC48756C627048AC3BAB89E5C7815B0853AEBBD47777A39C08E2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................RBNFRules.OrdinalRules.SpelloutRules.Version......3.:. .....;...1.:. .......;...2.:. .......;...4.:. .......;...-.x.:. ..">.>.;...0.:. ...........;...2...1...1.9...1.4...5.:. ...........;...-.x.:. ...... >.>.;...8.:. ...............;...6.:. .................;...7.:. .................;...9.:. .................;...0.:. .....=.#.,.#.#.0.=.;...1.0.:. .......[.. >.>.].;...2.0.:. .........[.. >.>.].;...4.0.:. ...........[.. >.>.].;...5.0.:. ...........[.. >.>.].;...9.0.:. ...........[.. >.>.].;...%.%.l.e.n.i.e.n.t.-.p.a.r.s.e.:...%.d.i.g.i.t.s.-.o.r.d.i.n.a.l.:...1.0.0.:. .<.<.. ....[.. >.>.].;...3.0.:. .............[.. >.>.].;...6.0.:. .............[.. >.>.].;...7.0.:. .............[.. >.>.].;...x...x.:. .<.<.. ....... >.>.>.;...8.0.:. ...............[.. >.>.].;...%.s.p.e.l.l.o.u.t.-.o.r.d.i.n.a.l.:...%.s.p.e.l.l.o.u.t.-.c.a.r.d.i.n.a.l.:...1.0.0.0.:. .<.<.. ........[.. >.>.].;...%.s.p.e.l.l.o.u.t.-.n.u.m.b.e.r.i.n.g.:...1.0.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\lv.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2640
                                                                                                                            Entropy (8bit):3.7860179628388178
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:RGEdE53ED4UurVJRqJ3vqActXcfHjurjuSoCo6:RGKY3i4UurVJcJ3vqAcNcfDsj1oCP
                                                                                                                            MD5:F4ABEDC58338889FC6D06BF10AF5E3EA
                                                                                                                            SHA1:35212AF034052457F2686E1E0B5D31AB1DE8F2D2
                                                                                                                            SHA-256:7BB0259CFAEEE039E9EBF5E558672DE9A2A593B0FEA7FB0568DDA3FAF56E488B
                                                                                                                            SHA-512:0863676CA9CBBEAF734EED03B3A8E83B69069E849C3B084931114F5915FB637B83D23A9A17D30F274CF35CC98A10044AE12B4EDA3FF69EF26FE4AAE41BF263D7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................RBNFRules.SpelloutRules.Version...2.:. .d.i.v.;...6.:. .s.e.a.;...3.:. .t.r.+.s.;...1.:. .v.i.e.n.;...2.:. .d.i.v.i.;...4.:. ...e.t.r.;...5.:. .p.i.e.c.;...6.:. .s.e.a.i.;...0.:. .n.u.l.l.e.;...1.:. .v.i.e.n.a.;...1.:. .v.i.e.n.s.;...2...1...2.7...2.2...2.:. .d.i.v.a.s.;...4.:. ...e.t.r.i.;...5.:. .p.i.e.c.i.;...6.:. .s.e.a.a.s.;...8.:. .a.s.t.o.F.;...9.:. .d.e.v.i.F.;...1.0.:. .E.R.R.O.R.;...4.:. ...e.t.r.a.s.;...5.:. .p.i.e.c.a.s.;...7.:. .s.e.p.t.i.F.;...8.:. .a.s.t.o.F.i.;...9.:. .d.e.v.i.F.i.;...1.0.:. .d.e.s.m.i.t.;...7.:. .s.e.p.t.i.F.i.;...8.:. .a.s.t.o.F.a.s.;...9.:. .d.e.v.i.F.a.s.;...x...x.:. .=.0...0.=.;...7.:. .s.e.p.t.i.F.a.s.;...-.x.:. .m.+.n.u.s. .>.>.;...1.0.0.:. .s.i.m.t.[. .>.>.].;...x...x.:. .<.<. .k.o.m.a.t.s. .>.>.;...1.0.0.0.:. .t.k.k.s.t.o.a.[. .>.>.].;...%.%.s.p.e.l.l.o.u.t.-.p.r.e.f.i.x.e.d.:...%.s.p.e.l.l.o.u.t.-.n.u.m.b.e.r.i.n.g.:...%.s.p.e.l.l.o.u.t.-.n.u.m.b.e.r.i.n.g.-.y.e.a.r.:...0.:. .=.%.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\ms.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1732
                                                                                                                            Entropy (8bit):3.701304332168578
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:Wk/WZlKB2JBEjEoKPJQcwNlJQJmGhpJm58meJvqEj9P2A0Z:WZl62JtPJQcwNlJQJhhpJrJvF9D0Z
                                                                                                                            MD5:1460F4EA03CF6115DE2DC70F022C5816
                                                                                                                            SHA1:3884E0697F4969D487F19BF5280CD54F0BE611D3
                                                                                                                            SHA-256:9C4A65707B6E08B8284BAC29DD1AD122CD813580CF02D804184CFC54BC2F86D9
                                                                                                                            SHA-512:A888F8E6F89B03B08A969275C8B870B697EE074655F823E61FB40C4BC86C084974F061A0609037F79C1898FC7186773524674E7F61800FCA10B1C15EE5EAF013
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................RBNFRules.OrdinalRules.SpelloutRules.Version......2.:. .d.u.a.;...1.:. .s.a.t.u.;...3.:. .t.i.g.a.;...5.:. .l.i.m.a.;...6.:. .e.n.a.m.;...1.:. .N.o... .1.;...2...1...4.9...2.4...4.:. .e.m.p.a.t.;...7.:. .t.u.j.u.h.;...8.:. .l.a.p.a.n.;...0.:. .k.o.s.o.n.g.;...1.:. .p.e.r.t.a.m.a.;...x...x.:. .=.0...0.=.;...0.:. .k.e.k.o.s.o.n.g.;...1.0.:. .s.e.p.u.l.u.h.;...1.1.:. .s.e.b.e.l.a.s.;...9.:. .s.e.m.b.i.l.a.n.;...1.2.:. .>.>. .b.e.l.a.s.;...0.:. .k.e.-.=.#.,.#.#.0.=.;...2.:. .k.e.-.=.#.,.#.#.0.=.;...-.x.:. .n.e.g.a.t.i.f. .>.>.;...x...x.:. .=.#.,.#.#.0...#.=.;...%.d.i.g.i.t.s.-.o.r.d.i.n.a.l.:...-.x.:. .."k.e.-.>.#.,.#.#.0.>.;...%.s.p.e.l.l.o.u.t.-.o.r.d.i.n.a.l.:...1.0.0.0.:. .s.e.r.i.b.u.[. .>.>.].;...1.0.0.:. .s.e.r.a.t.u.s.[. .>.>.].;...2.0.:. .<.<. .p.u.l.u.h.[. .>.>.].;...%.s.p.e.l.l.o.u.t.-.c.a.r.d.i.n.a.l.:...2.0.0.0.:. .<.<. .r.i.b.u.[. .>.>.].;...2.0.0.:. .<.<. .r.a.t.u.s.[. .>.>.].;...%.s.p.e.l.l.o.u.t.-.n.u.m.b.e.r.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\nl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4624
                                                                                                                            Entropy (8bit):3.732707836468624
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:YsqXJG7JKOuw+xojaNE7JtTpCHHjsvJJpmrqoQHN3tCwzsnVkbQ:RsGFKOuw+xojaNEFZpCHHjsvJJpmrqoz
                                                                                                                            MD5:77882A56008261A3F1C1B82C4742F04A
                                                                                                                            SHA1:74A3A994A98426A4DF69110784CB9615CFAD1CC7
                                                                                                                            SHA-256:69023C6711C9E5F709807508D1C3D0D0DD6004CE3B67D5E63775B06817B1B695
                                                                                                                            SHA-512:4EF697373D45BD3890F099F84FCF4CCAC5E0FB72D99A7A78A9FB414B73DBA1A33A926B215A7CBB9F6586A13354DB4A099BE8C476B61986D78E198A1ABC627CAC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................x.. ........|...|...........t...RBNFRules.OrdinalRules.SpelloutRules.Version......0.:. .n.u.l.;...0.:. .s.t.e.;...1.:. .e.e.n.;...6.:. .z.e.s.;...-.x.:. ..">.>.;...1.1.:. .e.l.f.;...2.:. .t.w.e.e.;...3.:. .d.r.i.e.;...4.:. .v.i.e.r.;...5.:. .v.i.j.f.;...8.:. .a.c.h.t.;...1.0.:. .t.i.e.n.;...2...1...2.7...2.2...3.:. .d.e.r.d.e.;...7.:. .z.e.v.e.n.;...9.:. .n.e.g.e.n.;...%.%.2.d.-.y.e.a.r.:...%.%.o.r.d.-.s.t.e.:...0.:. .n.u.l.s.t.e.;...1.:. .e.e.r.s.t.e.;...2.:. .t.w.e.e.d.e.;...-.x.:. .m.i.n. .>.>.;...0.:. .h.o.n.d.e.r.d.;...1.2.:. .t.w.a.a.l.f.;...1.:. .e.e.n...e.n...;...x...x.:. .=.0...0.=.;...%.%.n.u.m.b.e.r.-.e.n.:...0.:. .=.#.,.#.#.0.=.e.;...1.3.:. .d.e.r.t.i.e.n.;...1.6.:. .z.e.s.t.i.e.n.;...2.:. .t.w.e.e.....n...;...3.:. .d.r.i.e.....n...;...1.4.:. .v.e.e.r.t.i.e.n.;...1.5.:. .v.i.j.f.t.i.e.n.;...1.8.:. .a.c.h.t.t.i.e.n.;...1.7.:. .z.e.v.e.n.t.i.e.n.;...1.9.:. .n.e.g.e.n.t.i.e.n.;...x...x.:. .=.#.,.#.#.0...#.=.;...%.d.i.g.i.t.s.-.o.r.d.i.n.a.l.:...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\nn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2500
                                                                                                                            Entropy (8bit):3.6660537150244776
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:J6Cvv95WbmI8WHefJuJZJKnJR740JkAy+va2iIR:J66TpJuJZJUJN40JkH+va2iIR
                                                                                                                            MD5:D4CA11A28FE9CA6C7C4B825858F77E63
                                                                                                                            SHA1:103B17E07834B90BF3667EB01AA6696AA789C6A2
                                                                                                                            SHA-256:7692B359182320A6BBDE8104B3103C82B8C7DD6E626186AC8E427C406C7CC95D
                                                                                                                            SHA-512:6476A42D66D46F84D2B76A0152AC574EC13D3939606C37D97378C9C06AE7C9F421CC79D3F1C3C5D0F4DC8B191C1376900C3D48790E38ACF0A4BD46DE363F4B89
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................e.. ........i...i...........c...RBNFRules.SpelloutRules.Version...2.:. .t.o.;...9.:. .n.i.;...1.0.:. .t.i.;...1.:. ...i.n.;...3.:. .t.r.e.;...5.:. .f.e.m.;...7.:. .s.j.u.;...0.:. .n.u.l.l.;...1.:. .e.i.t.t.;...4.:. .f.i.r.e.;...6.:. .s.e.k.s.;...8.:. ...t.t.e.;...1.2.:. .t.o.l.v.;...2...1...2.7...2.2...1.8.:. .a.t.t.e.n.;...1.1.:. .e.l.l.e.v.e.;...1.5.:. .f.e.m.t.e.n.;...1.7.:. .s.y.t.t.e.n.;...1.9.:. .n.i.t.t.e.n.;...x...x.:. .=.0...0.=.;...1.3.:. .t.r.e.t.t.e.n.;...1.4.:. .f.j.o.r.t.e.n.;...1.6.:. .s.e.k.s.t.e.n.;...-.x.:. .m.i.n.u.s. .>.>.;...2.0.:. .t.j.u.e.[...>.>.].;...8.0.:. ...t.t.i.[...>.>.].;...4.0.:. .f...r.t.i.[...>.>.].;...5.0.:. .f.e.m.t.i.[...>.>.].;...7.0.:. .s...t.t.i.[...>.>.].;...9.0.:. .n.i.t.t.i.[...>.>.].;...%.%.l.e.n.i.e.n.t.-.p.a.r.s.e.:...3.0.:. .t.r.e.t.t.i.[...>.>.].;...6.0.:. .s.e.k.s.t.i.[...>.>.].;...x...x.:. .<.<. .k.o.m.m.a. .>.>.;...%.s.p.e.l.l.o.u.t.-.n.u.m.b.e.r.i.n.g.:...%.s.p.e.l.l.o.u.t.-.c.a.r.d.i.n.a.l.-.r.e.a.l.e.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\pl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25220
                                                                                                                            Entropy (8bit):3.7264725011803574
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:Ih1+wDzFI1ZWX2yrKPeyLRaAoCETlR4BB7P04Q/L+YQYc3G/2qksDYnRRXN05OAS:IhnzFI1Zz
                                                                                                                            MD5:2E98F4B0C4F9B87B9EAF9DABBBE909F4
                                                                                                                            SHA1:11E45654290B44B19B0A6168ED1219242015EB5A
                                                                                                                            SHA-256:8EFD9EDC995E6522DCD7C4698698AC5EE1758D5B89C2F7ED5DCCC3402103B2D1
                                                                                                                            SHA-512:C34529A88F44624A44A829AE6265816F49BC43E6B0FBBE9FBC1B9F74FD2E3264A2D71D34B5C0834EC0EE1DCA46F4BE7E1EF4DE489E29B49E20F873DF4F2B156B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................RBNFRules.SpelloutRules.Version...2.:. .d.w.a.;...0.:. .z.e.r.o.;...0.:. .z.e.r.a.;...0.:. .z.e.r.u.;...3.:. .t.r.z.y.;...5.:. .p.i.....;...2.:. .d.w.a.j.;...2.:. .d.w.i.e.;...2.:. .d.w...m.;...1.:. .j.e.d.e.n.;...8.:. .o.[.m.i.u.;...0.:. .z.e.r.e.m.;...0.:. .z.e.r.z.e.;...1.:. .j.e.d.n.o.;...1.:. .j.e.d.n...;...2.:. .d.w...c.h.;...6.:. .s.z.e.[...;...8.:. .o.s.i.e.m.;...1.:. .j.e.d.n.a.;...2...1...2.7...2.2...2.:. .d.w.o.m.a.;...3.:. .t.r.z.e.j.;...3.:. .t.r.z.e.m.;...1.:. .j.e.d.n.e.j.;...5.:. .p.i...c.i.u.;...1.:. .j.e.d.n.y.m.;...3.:. .t.r.z.e.c.h.;...4.:. .c.z.t.e.r.y.;...7.:. .s.i.e.d.e.m.;...1.0.:. .<.<. .>.>.;...2.:. .d.w.i.e.m.a.;...3.:. .t.r.z.e.m.a.;...6.:. .s.z.e.[.c.i.u.;...7.:. .s.i.e.d.m.i.u.;...1.:. .j.e.d.n.e.g.o.;...1.:. .j.e.d.n.e.m.u.;...4.:. .c.z.t.e.r.e.j.;...4.:. .c.z.t.e.r.e.m.;...8.:. .o.[.m.i.o.m.a.;...x...x.:. .=.0...0.=.;...4.:. .c.z.t.e.r.e.c.h.;...9.:. .d.z.i.e.w.i.....;...1.:. .d.z.i.e.s.i...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\root.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17280
                                                                                                                            Entropy (8bit):4.238350514170709
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:oc+4C2W7kf0W+crMhJf7lJGJGfg6GuqkPB4vrngY:U4A2kJTlYYY6GprnF
                                                                                                                            MD5:58AC541781B11DCC8F721CCCCD705366
                                                                                                                            SHA1:99D2EA7E7A71E287F36545F68F5589026E3BAA25
                                                                                                                            SHA-256:CBD89E41C0C7C95EB88EC3940253E16F55D28F4DB561AE03A8D3CCBFA89CF381
                                                                                                                            SHA-512:00E3ACF1D17A5474E8AB4F29EC114DF7F3FAD4C7113181AFACEC8C50137EC866AB498A9578F2779268DC2740DCB5B4D8D928273DAABB4E4406FA24E1F5C9F955
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................RBNFRules.DurationRules.NumberingSystemRules.OrdinalRules.SpelloutRules.Version...0.:. ...;...0.:. .0.;...0.:. .N.;...0.:. .n.;...0.:. ...;...0.:. ...;...0.:. ...;...0.:. .|.;...1.:. .I.;...1.:. .i.;...1.:. ...;...1.:. ...;...1.:. .0.;...1.:. .1.;...1.:. .a.;...1.:. ...;...1.:. ...;...1.:. ...;...1.:. .i.;...2.:. ...;...2.:. ...;...2.:. .2.;...2.:. .2.;...2.:. .b.;...2.:. ...;...2.:. ...;...2.:. ...;...2.:. .j.;...3.:. ...;...3.:. ...;...3.:. .3.;...3.:. .3.;...3.:. .c.;...3.:. ...;...3.:. ...;...3.:. ...;...3.:. .k.;...4.:. ...;...4.:. ...;...4.:. .4.;...4.:. .4.;...4.:. .d.;...4.:. ...;...4.:. ...;...4.:. ...;...4.:. .l.;...5.:. .V.;...5.:. .v.;...5.:. ...;...5.:. ...;...5.:. .T.;...5.:. .5.;...5.:. .e.;...5.:. ...;...5.:. ...;...5.:. ...;...5.:. .m.;...6.:. ...;...6.:. ...;...6.:. .U.;...6.:. .6.;...6.:. .f.;...6.:. ...;...6.:. ...;...6.:. ...;...6.:. .n.;...7.:. ...;...7.:. ...;...7.:. .7.;...7.:. .7.;...7.:. .g.;...7.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\sh.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):96
                                                                                                                            Entropy (8bit):2.7117247151533226
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlR/PllvlsltloXNglLMGC:SBtkJJelXo6JfC
                                                                                                                            MD5:8008B9DEE0A40CFFBCF57D7734003A47
                                                                                                                            SHA1:1A4FE2832062EBC1ECD27AFFECA8CBF7D91881DD
                                                                                                                            SHA-256:11921ED1C9B00C83E37CE919FE114789A8F6B14131F26996BF6F564D2D3F5A14
                                                                                                                            SHA-512:F9DB4A4DACA509B749193BC0C528C2B497A5E11A25B6884C47FB7354920BE62C0BA9DFAC1F5633D000FF6C714241751BD5D417227A0C5862D259BAB8F2A4190B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...s.r._.L.a.t.n..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\sl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3580
                                                                                                                            Entropy (8bit):3.8104436721883586
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:iPhTXA6Jur0JjcJVSF72dIEB8j9hxgVqAD0as:MhU0urKjyVSF72dIEB8j9hxgVqus
                                                                                                                            MD5:EC42639574648397DCD567F7C42EE2C5
                                                                                                                            SHA1:DA9E597605FE0D68DF2EA2B75BBC3A1FE8824E52
                                                                                                                            SHA-256:2EE11EDAD8854492F07CB713D82AC77CAE93345FCE997F366634485E5FE2850F
                                                                                                                            SHA-512:4FE4EE5C58FB76DA73C6A874EDC06A77F96DD1AFE4A4E208D4C76C210F78EE5822AA82A8C7883A57CD825A8BECD4E1E6E2FC6DC53242C1AC8515BDE08520616C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................s.. ........w...w...........q...RBNFRules.SpelloutRules.Version...0.:. .n.i...;...1.:. .e.n.a.;...2.:. .d.v.a.;...2.:. .d.v.e.;...3.:. .t.r.i.;...5.:. .p.e.t.;...6.:. .a.e.s.t.;...8.:. .o.s.e.m.;...2...1...2.7...2.2...2.:. .d.v.i.j.e.;...4.:. .a.t.i.r.i.;...7.:. .s.e.d.e.m.;...9.:. .d.e.v.e.t.;...1.0.:. .d.e.s.e.t.;...1.1.:. .e.n.a.j.s.t.;...x...x.:. .=.0...0.=.;...-.x.:. .m.i.n.u.s. .>.>.;...1.2.:. .d.v.a.n.a.j.s.t.;...1.3.:. .t.r.i.n.a.j.s.t.;...1.5.:. .p.e.t.n.a.j.s.t.;...1.0.0.:. .s.t.o.[. .>.>.].;...1.4.:. .a.t.r.i.n.a.j.s.t.;...1.6.:. .a.e.s.t.n.a.j.s.t.;...1.8.:. .a.s.e.m.n.a.j.s.t.;...1.7.:. .s.e.d.e.m.n.a.j.s.t.;...1.9.:. .d.e.v.e.t.n.a.j.s.t.;...2.0.:. .d.v.a.s.e.t.[. .>.>.].;...6.0.0.:. .a.e.s.t.o.[. .>.>.].;...3.0.0.:. .t.r.i.s.t.o.[. .>.>.].;...3.0.:. .<.<.d.e.s.e.t.[. .>.>.].;...5.0.0.:. .p.e.t.s.t.o.[. .>.>.].;...1.0.0.0.:. .t.i.s.u...u.[. .>.>.].;...2.0.0.:. .d.v.j.e.s.t.o.[. .>.>.].;...8.0.0.:. .o.s.e.m.s.t.o.[. .>.>.].;...x...x.:. .<.<.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\uk.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3376
                                                                                                                            Entropy (8bit):4.405866321543506
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:Svo9u9qDct+kkJoV2UJur0JjcJVS7WD9UTsrks+7gan:p9u9qDctfkJo4qurKjyVS7WpUTsrkn
                                                                                                                            MD5:EEA91630C532D6A0B1AA586781C3E2A0
                                                                                                                            SHA1:957EA5B1FE419BCA6DE2E3020E8C26EE90B89270
                                                                                                                            SHA-256:E0B64AA76A7CD706ABF068A9EA3B804939C2FFD922E1B38E6E57B02C72703984
                                                                                                                            SHA-512:4D1AFF63D794896E2171A91CACE250F630479A7152E56AD1CADD66587ADB40BD8BC4179C5216689C69A4735C1C48E95E9889816A6CB8F4E10150ADB01807D9E2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................@.. ........D...D...........>...RBNFRules.SpelloutRules.Version...2.:. .4.2.0.;...2.:. .4.2.V.;...3.:. .B.@.8.;...7.:. .A.V.<.;...0.:. .=.C.;.L.;...1.:. .>.4.8.=.;...1.:. .>.4.=.0.;...1.:. .>.4.=.5.;...2...1...3.0...6.2...5.:. .?...O.B.L.;...6.:. .H.V.A.B.L.;...8.:. .2.V.A.V.<.;...4.:. .G.>.B.8.@.8.;...1.0.:. .4.5.A.O.B.L.;...9.:. .4.5.2...O.B.L.;...x...x.:. .=.0...0.=.;...-.x.:. .<.V.=.C.A. .>.>.;...1.0.0.:. .A.B.>.[. .>.>.].;...4.0.:. .A.>.@.>.:.[. .>.>.].;...1.1.:. .>.4.8.=.0.4.F.O.B.L.;...1.2.:. .4.2.0.=.0.4.F.O.B.L.;...1.3.:. .B.@.8.=.0.4.F.O.B.L.;...1.7.:. .A.V.<.=.0.4.F.O.B.L.;...x...x.:. .<.<. .:.>.<.0. .>.>.;...%.%.l.e.n.i.e.n.t.-.p.a.r.s.e.:...1.5.:. .?...O.B.=.0.4.F.O.B.L.;...1.6.:. .H.V.A.B.=.0.4.F.O.B.L.;...2.0.0.:. .4.2.V.A.B.V.[. .>.>.].;...3.0.0.:. .B.@.8.A.B.0.[. .>.>.].;...7.0.0.:. .A.V.<.A.>.B.[. .>.>.].;...1.4.:. .G.>.B.8.@.=.0.4.F.O.B.L.;...1.8.:. .2.V.A.V.<.=.0.4.F.O.B.L.;...2.0.:. .4.2.0.4.F.O.B.L.[. .>.>.].;...3.0.:. .B.@.8.4.F.O.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\yue.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5360
                                                                                                                            Entropy (8bit):3.9325362330462403
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:JFkVgrbFCDDebtedcbafD1FA/hJqvwzyk6yoQrre1JHhM0nwl32+lLIwb4Mlpnbn:Jzh2jEqvwzyk6y/rrebHh0l32+l8wUM3
                                                                                                                            MD5:FD4A4AFB2120B5B91A253D5C190864B2
                                                                                                                            SHA1:53D9E6DECC9BFF43C59C6A6041CDDD9F7226AA2E
                                                                                                                            SHA-256:EFB949EDD7C1AC82CB265E08B13C5B083A0F7D17222CEC8B4B54E717007346BD
                                                                                                                            SHA-512:875755F8925163115089BF6656F7A2FA578163F11A510E64CD0C16A49D4536F8481B93CD88FAFF0DF3EF0C2263AFDB59E264BA6684806A4947DFE95B92F7272D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................0.. ........4...4...........,...RBNFRules.OrdinalRules.SpelloutRules.Version......1.:. .;...0.:. ...;...1.:. ..N;...2.:. ..N;...3.:. ..N;...4.:. ..V;...5.:. ..N;...6.:. .mQ;...7.:. ..N;...8.:. .kQ;...9.:. .]N;...1.:. ..X;...2.:. .iQ;...2.:. ...;...3.:. ..S;...4.:. ...;...5.:. ..O;...6.:. .x.;...7.:. ..g;...8.:. .Lc;...9.:. ..s;...-.x.:. ...>.>.;...2...1...4.6...2.4...%.%.n.u.m.b.e.r.2.:...%.%.n.u.m.b.e.r.3.:...%.%.n.u.m.b.e.r.4.:...%.%.n.u.m.b.e.r.5.:...%.%.n.u.m.b.e.r.8.:...1.0.:. .<.<.>.>.>.;...1.0.:. .AS[.>.>.].;...1.0.:. ..b[.>.>.].;...%.%.n.u.m.b.e.r.1.3.:...1.0.0.:. .<.<.>.>.>.;...x...x.:. .=.0...0.=.;...x...x.:. .<.<..>.>.>.;...0.:. .,{=.#.,.#.#.0.=.;...1.0.0.0.:. .<.<.>.>.>.;...2.0.:. .<.<.AS[.>.>.].;...2.0.:. .<.<..b[.>.>.].;...-.x.:. .,{.">.#.,.#.#.0.>.;...x...x.:. .=.#.,.#.#.0...#.=.;...%.d.i.g.i.t.s.-.o.r.d.i.n.a.l.:...%.s.p.e.l.l.o.u.t.-.o.r.d.i.n.a.l.:...%.%.f.i.n.a.n.c.i.a.l.n.u.m.b.e.r.2.:...%.%.f.i.n.a.n.c.i.a.l.n.u.m.b.e.r.3.:...%.%.f.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\yue_Hans.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5380
                                                                                                                            Entropy (8bit):3.930340376547179
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:CFkVwQOFCDDeeJtedcbafD1FA/0Jqvwzyk6yOQrre1JHhM0nwl32+lLIwb4Mlpn7:QeD2jtqvwzyk6y5rrebHh0l32+l8wUMP
                                                                                                                            MD5:654DDCE86B0E66D0220B1B7E85F61086
                                                                                                                            SHA1:17809A21250BD16D045647F47BE693FD18560B92
                                                                                                                            SHA-256:87ABAB358592A98E817B78959BE063F2822DCD7CA769A8FC6C86BD5E8AB35320
                                                                                                                            SHA-512:5EF8B16BD9DAAE24442D4C80B3353C904D6F0F88864A4DC9AAACCD5AE3CF563F729219785C00BCDFC6D78EAFA202BEBDA9C3831FADE661693ED93FF6E39CDAAC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................4.. ........9...9...........0...%%Parent.RBNFRules.OrdinalRules.SpelloutRules.Version.....1.:. .;...r.o.o.t...0.:. ...;...1.:. ..N;...2.:. ..N;...3.:. ..N;...4.:. ..V;...5.:. ..N;...6.:. .mQ;...7.:. ..N;...8.:. .kQ;...9.:. .]N;...1.:. ..X;...2.:. .$N;...2.:. .0.;...3.:. ..S;...4.:. ...;...5.:. ..O;...6.:. .F.;...7.:. ..g;...8.:. .Lc;...9.:. ..s;...-.x.:. ...>.>.;...2...1...4.8...7.7...%.%.n.u.m.b.e.r.2.:...%.%.n.u.m.b.e.r.3.:...%.%.n.u.m.b.e.r.4.:...%.%.n.u.m.b.e.r.5.:...%.%.n.u.m.b.e.r.8.:...1.0.:. .<.<.>.>.>.;...1.0.:. .AS[.>.>.].;...1.0.:. ..b[.>.>.].;...%.%.n.u.m.b.e.r.1.3.:...1.0.0.:. .<.<.>.>.>.;...x...x.:. .=.0...0.=.;...x...x.:. .<.<..p>.>.>.;...0.:. .,{=.#.,.#.#.0.=.;...1.0.0.0.:. .<.<.>.>.>.;...2.0.:. .<.<.AS[.>.>.].;...2.0.:. .<.<..b[.>.>.].;...-.x.:. .,{.">.#.,.#.#.0.>.;...x...x.:. .=.#.,.#.#.0...#.=.;...%.d.i.g.i.t.s.-.o.r.d.i.n.a.l.:...%.s.p.e.l.l.o.u.t.-.o.r.d.i.n.a.l.:...%.%.f.i.n.a.n.c.i.a.l.n.u.m.b.e.r.2.:...%.%.f.i.n.a.n.c.i.a.l.n.u.m.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\zh_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.587503530614347
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlw1ylRl/jlklbl+vKalllkC:SBtkJQ2aRalsC
                                                                                                                            MD5:CD838BDE437B8246547E3DA5B56BC92B
                                                                                                                            SHA1:7B56EF405386E67AD77E890927ACF9CE8EBA77C4
                                                                                                                            SHA-256:BE404D9CC9737C0A22CB01C5FE5ED35C37CD87A22C5DBE18893AF3DCC8946816
                                                                                                                            SHA-512:D9C4D18DE93F999801B873680BE8502ED67DA0665C04E3B182AC1A3BB02E34F82C3B6DDCA54BAD84D37D727F030E2934C73A81FBB6D4779D02CED04528E07492
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...y.u.e..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\zh_TW.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):96
                                                                                                                            Entropy (8bit):2.7533913818199895
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlR/Pllvlsltloe1zRqa:SBtkJJelXoeZH
                                                                                                                            MD5:B01F5E12A340DAA68ECF97BEE56D319B
                                                                                                                            SHA1:0FFEE54D754C18D881CCCDE4E3E62F1D510C4A6B
                                                                                                                            SHA-256:288721EEEF5C876ABD385C1CD229ECB72525B1FE396651ADB546CC681ABFD8EB
                                                                                                                            SHA-512:0B2745AB2D7E702C06ADAE932E248024ED4903A05A30244C6CFC56E6BC45B0886CF3F3D6231F693A48FDBF454A3BAD44F6FA675B9D7716EEFA53C67303824570
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................%%ALIAS...z.h._.H.a.n.t..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\agq.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5716
                                                                                                                            Entropy (8bit):4.524867939073992
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:2A6ZJ8Fe/VPPOvqy0Seo+xM+rLHAJPg/hE4kqefJ6aAsZOXV19gV81yWelU0kXF7:eLqRvao7SLHABgpEzVh6atZOXb9gekUh
                                                                                                                            MD5:2C4812488B86E32A65469F8A00BDF496
                                                                                                                            SHA1:BC7F9E55EE1C39CCB3F1973B51FFC7C780C0BB98
                                                                                                                            SHA-256:297CBE32B6E0920037DC365944CB981C622A0F1FA4B9AD798BE269BE20CB5AB7
                                                                                                                            SHA-512:601DBA2B99AF9FD1636F1553B9F0A9EFCA7F1698158B442490199A2F75F31B1731ACA5DF5078C64E2D14C9BA9129EFEE67289B43EF282B5B9D7DB7C073C67C2A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .8....................8.....5K.y..C.h.....E.d.z.....K.a.t.....M.a.l.....T.u.g.....U.m...n.....l...n...C.h.i.l.....E.n.d...a...E.t.a.l.....F.i.d.z.i...G.a.a.n.....G...b...n...H...e.t.....K.p.[.l.....K...w.[.....K.h.n.y.....L.e.b...a...L...w.o.s...M.a.a.t.....S.i.l...a...S...d...n...T.e.e.k.....T.u.K.g.......l.u.b.....B...l.a.e.n...B...l.e.v.....C.h.a.e.n.....D.z.o.d...n...D.[.n.h.m.....E.k.w.a.d.....F.h.n.l...n...G.a.m.b...a...G...y.a.n.....G.h...l...s...K.a.n.a.d.....K.p.u.l...n...K.u.u.w.b.....L.o.s.h...a...L...t.h.v.a...L.[.b.a.n.....M.b.u.t...n...M...d.i.v.....M...l.a.w.....M...y.o.t.....M...l.o.k.....M...n.a.k.u...M...a.n.m.....N.a.e.d.z.....N...w.u.l.....N.[.k.p...a...S...m.o.w.....T.a.e.l...n...T.a.e.w...n...Y.[.m.[...n...Z.a.m.b...a.....n.d.o.l.......K.g.o.l.......l...k.h.....B...b.a.d...s...B...h.a.m...s...B...l.u.n.d.....B.[.l...l...s...B.[...m.u.d.....B.[...n.h...K...B.h...l.u.n.....D.z.a.m.a.n.....D.z...k.p...n...D.z...m.[.k.....E.s...v.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ar_LY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):120
                                                                                                                            Entropy (8bit):3.912622054212684
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlmdlzpll8l/Vlld0yzlYq4v/6l/qaMF:Sv2Oltll9zl5EaMF
                                                                                                                            MD5:A1D6134CC0DEC5125CBA9339D5658781
                                                                                                                            SHA1:073953C53A746A9B003B95462F28D5AF00D1A189
                                                                                                                            SHA-256:D7BF75F303DF4BB4E8DBA6016E67B6901947C92144129C4540A258FC9175F785
                                                                                                                            SHA-512:166F4CA393A3B514918A586861ECDE4B8FF6E3AC081D1E6A806130011F55E15349B47E456111F2355548768FBAF596F86E2CF8AFC935F377AD530B1F49C54E07
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..Q....................Q....5K.y..#.H.1.H.:.H.'.J.....F.].\..QY>.Q.............P.!.`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\az.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6592
                                                                                                                            Entropy (8bit):4.592454757656165
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:0spjGoqhrfV5z00qGXf7JL9zgtXZQle3cHpqpJ8E48yDt:0mXATf7JpzNe3Opq8E4FDt
                                                                                                                            MD5:D33720B863D79B6CE8ECBE9166C5B427
                                                                                                                            SHA1:1DC8D0EED1EE53F2B2F68CDA4DA225D1E00F1D25
                                                                                                                            SHA-256:DBE1A55E16D203E05A6418980F0CCF67E74200D8FE2FE7E7DE18CF49284D62E9
                                                                                                                            SHA-512:B7BAC79AB8CBACF975B01FE5C341CA6724F45A472D33FB6B42F8CE6B67E5170E9545C1A4C609B14E1631A48EB01BA14F1273290FCFEDD564A67DA6F250A9F1E5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................a.. ........h...h...&.......a...5K.y..B.K...A.B.^...B.M.T...F.i.c.i...Q.a.n.a...Q.u.a.m...T.o.q.o.....i.l.i...0.r.a.n...0.r.a.q...C.e.r.s.i...D...n.y.a...K.a.r.i.b...L.i.v.a.n...M.i.s.i.r...P.o.l._.a...Q.a.b.o.n...Q.Y.t.Y.r...T.o.n.q.a...Y.Y.m.Y.n...0.s.v.e.....A.n.q.o.l.a...C.i.b.u.t.i...K...v.e.y.t...L.i.v.i.y.a...M.y.a.n.m.a...N.o.r.v.e.....Q.a.y.a.n.a...S.u.r.i.y.a...U.q.a.n.d.a.....e.x.i.y.a...0.s.r.a.i.l...A.n.g.i.l.y.a...B.e.l...i.k.a...B.Y.h.r.e.y.n...K.a.m.b.o.c.a...M.a.v.r.i.k.i...M.Y.r.a.k.e._...Q.a.m.b.i.y.a...Q.r.e.n.a.d.a...S.e.n.e.q.a.l...S.e.r.b.i.y.a...T...r.k.i.y.Y...U.k.r.a.y.n.a...U.r.u.q.v.a.y...V.y.e.t.n.a.m...Y.a.m.a.y.k.a...0.s.v.e...r.Y...0.t.a.l.i.y.a...A.l.m.a.n.i.y.a...A.v.r.o.z.o.n.a...A.v.s.t.r.i.y.a...E.f.i.o.p.i.y.a...E.r.i.t.r.e.y.a...F.Y.l.Y.s.t.i.n...P.a.r.a.q.v.a.y...R.e.y.u.n.y.o.n...R.u.m.1.n.i.y.a...S.i.n.q.a.p.u.r...Y.a.p.o.n.i.y.a...0.s.p.a.n.i.y.a.....l.c.Y.z.a.i.r...B.a.n.q.l.a.d.e._...G...r.c...s.t.a.n...H.o.n.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\az_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9586234771141804
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwM86E7lz1BsNE:Sv9t6gz17
                                                                                                                            MD5:C22EC8E4B84B84647296660688B6D7BB
                                                                                                                            SHA1:2FE414FD38932DCBEADACC13175680F8C0ABD8E7
                                                                                                                            SHA-256:37FF94DAEF52A8B76ED3DCE758A446BC79EDE3349F84134BEFAA7225C99D58B3
                                                                                                                            SHA-512:FFA514030D42EF8975FA25B9A20E94A0DBBE63EDBF9C4DAA74631A8FE0BA1A6FF4552AEBB8C6D69A058E2D71F7D169C498E5A42F8FC06465F1EA61E821C0A15B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y.......!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\az_Latn_AZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/dsp:SBtkJ1li6gml/8
                                                                                                                            MD5:3F209B3AA35603DCBB208A74CAA36C86
                                                                                                                            SHA1:249DE057005BE697205333ABA0433C5B04653BBB
                                                                                                                            SHA-256:F3965E339C622C96879DEE316DE42F9E9F693DDEB7A52FDCEBBA027171F2C86A
                                                                                                                            SHA-512:02411AE5728814057E0CA78D850EEA85B3ACA16DFDBEE97A7C01860DA3B82640EEBE60960938C7F64B05D9E9FE8BAE0B826D242E24B33C40024836F716F17E31
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\bas.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5216
                                                                                                                            Entropy (8bit):4.526885334594306
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:dxWEZi2CmE2x15Q4WtoyJ36LuKI/rHKkXF9D1+DLPb2G:BV2os8s36qr/jtFRIF
                                                                                                                            MD5:05A574C06D6947FA65E06359D1AD5A2A
                                                                                                                            SHA1:162B3B88B25645B893B571B2ED33BD959520B1BB
                                                                                                                            SHA-256:78E71D23578DAD3FD0076FE41BFC6E8DE35DE5B7F3E71683E378C978B2F366CE
                                                                                                                            SHA-512:892301DA11CF5E0EC9FFEB7330DA7BB4AD6D809ED809B3BADAED486AE6F035F788FC82A1BFE43150CE411DC5DCCF587E1B36426FD9388AE042317099A6E54C51
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .C!...................C!....5K.y..C...d...G.a.n.....G...n.....G.....m...K.i.n.....K.u.b.....K...l.....L.....s...M...l.i...N.e.r.....P...r.....T...g.o.....i.t.......r...k.....r...K.....m...n...B...l...s...B...t...n...I.n.d.......J.a.m...n...K.e.n.......K.i.p.r.....K...t...r...K...w...t...K...K.g.o...L.i.b.......M.a.l.t.....M...r...s...N...p...l...N...u.[.....P...l.a.....P...n.y.a...S.i.r.......S...m.o.....S...d...K...S...w...s...T.T.K.g.......r.u.b.....B.r...s...l...B...r.a...n...B...n.[...K...D...m.n...k...G.r...k.y.....G...b.T...K...G...m.b.i.....G...y.a.n.....J...b.u.t.....K...n.a.d.....L.e.s...t.....L...d.v.i.....M...l.d...f...M...l...w.i...M...r.o.k.....M...y.T...t...M...n.a.k.....N...j.[...r...P...n...m.a...P...l...n.d...R...a.n.d.....S...s.[...l...T...y.w...n...T...r.k...y...T...v...l.....Y...m.[...n...Z...m.b.i.......K.d.T...r.....K.g.i.y.......K.g.o.l.......g...p.t.......r.l...n.d.....t.a.l.........s.t.r...k.....g.a.n.d.......k.r.[...n.....l.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\be.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):7608
                                                                                                                            Entropy (8bit):4.677065664643768
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:tF48CTqdS4paQnSto7IPOI8CYvJvOtgKS2xLROx2RHmQP2tn7BG8hCXKQH1hoZcV:orx4p2Mj5GVit1BQDlHNJqpJ80Y
                                                                                                                            MD5:34DEE5BB69C136432F75147A649AB0AC
                                                                                                                            SHA1:330CE54E21EA1FEFD477CD85EECC25468F192CFD
                                                                                                                            SHA-256:EB5730CAAA7EB7DE6AD24E3E610956069960689B2A42769BBE8B027F7918CD98
                                                                                                                            SHA-512:C8CD2E670FFD6E74DA436CED188F5C55AC75542CA233F714C251F785DB4CA11D8EA1B6623E0C9E41888B90963E9E85B4D74A21F88D52AFC510702DA4A36874EF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................_.. ........f...f...$......._...5K.y............@.0.:.....@.0.=.....<.0.=.....<.5.=.....V.?.@.....0.;.V.....V.C.M...!.2.5.B...".>.3.0...'.K.;.V.....=.4.K.O.....;.6.K.@.....5.;.V.7.....5.=.V.=.....0.V.F.V.....0.=.V.O.....5.=.V.O.....V.B.0.9.....V.2.0.=.....V.2.V.O.....V.B.2.0.....0.:.0.0.....0.Q.B.0.....V.3.5.@... .0.A.V.O...!.V.@.K.O...".C.=.V.A...$.V.4.6.K...'.M.E.V.O.....B.0.;.V.O.....0.<.1.V.O.....5.@.=.A.V.....@.C.7.V.O.....@.M.F.K.O.....6.M.@.A.V.....3.V.?.5.B.....0.<.1.V.O.....>.A.0.2.0.....0.B.2.V.O.....5.A.>.B.0.....0.;.0.2.V.....0.=.0.:.0.....0.@.>.:.0...!.0.<.0.;.V...!.5.@.1.V.O...".C.@.F.K.O...(.2.5.F.K.O.../.?.>.=.V.O.....7.@.0.V.;.L.....A.?.0.=.V.O.....;.1.0.=.V.O.....=.3.V.;.L.O.....@.<.5.=.V.O.....^.A.B.@.K.O.....0.;.V.2.V.O.....0.E.@.M.9.=.....5.;.L.3.V.O.....0.B.K.:.0.=.....5.=.3.@.K.O...... 5.B.=.0.<.....0.=.:.>.=.3.....@.M.=.0.4.0.....6.K.1.C.F.V.....N.@.0.A.0.0.....V.1.5.@.K.O.....0.;.4.>.2.0.....5.:.A.V.:.0.....0.<.V.1.V.O.....V.3.5.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\bn_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.3908502676203804
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQuHcKt7g8sOtWwT/r9h:SvFv1UwTDX
                                                                                                                            MD5:0A1233FBDE8BB786513730F248C00A3F
                                                                                                                            SHA1:7232253BF6AA1D12EEC2699394B98C99B04185EA
                                                                                                                            SHA-256:45851FFA7B67ECB0A7D7C0BF4EEF7AE7BF66C5747D8833C5FE65966D28AEA026
                                                                                                                            SHA-512:6C0F7E0F00F5A49CB8720C9AF67A868145667182B5297ED8F871FFD83D2AF559DF7C2A968F99295E46A8E3831CF60350404AA511747689B3067B518091B9E5D8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................5K.y....S........H.............P...P.!.`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ce.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6384
                                                                                                                            Entropy (8bit):4.7904041426974775
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:d42p26D71OkW7RICj+p96V7sH7x6q9AdHqppH8nzbqZMJxjRilZ:dtpLkkDoI7x6BqpJ8iZMxjRwZ
                                                                                                                            MD5:EBAB657F132AB733710CB9FCA1CCC4B9
                                                                                                                            SHA1:AC1097560B86A22C7471EA87AB52F4A40804E093
                                                                                                                            SHA-256:70A4F88D751906FD2649AEAAE435DE4D5F5CA3C6101E023DF2480807ED0E0431
                                                                                                                            SHA-512:2174DA9026E5B4BF6590BC3EEE038A8711B8BDA987985109DBD5B8DED878CCDB2C795A18BF2870E15FFF006497D9684137A98F4D8BC2FA4305437BC811900E9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................-.. .U......4...4...#.....U.-...5K.y....&.(.....0.=.8.....5.=.8.....8.2.8...'.5.E.8...(.5.<.0.....0.<.1.8.....@.5.F.8.....0.<.1.8.....0.B.2.8.....8.A.0.@... .>.A.A.8...!.5.@.1.8...#.@.4.0.=...(.2.5.F.8.../.?.>.=.8.....>.<.0.=.....2.A.B.@.8.....;.1.0.=.8.....5.;.L.3.8.....>.;.8.2.8.....5.=.3.@.8.....A.?.0.=.8.....8.1.5.@.8.....0.<.8.1.8.....8.3.5.@.8... .C.<.K.=.8...$.@.0.=.F.8...%...8.=.4.8...&.8.9.G.>.L...-.A.B.>.=.8...-.D.8.>.?.8.....8.@.0.:.J.....>.;.3.0.@.8.....@.0.7.8.;.8.....5.@.<.0.=.8.....@.;.0.=.4.8.....A.;.0.=.4.8.....0.@.8.1.0.H.....8.@.3.8.7.8.....>.;.C.<.1.8.....>.<.>.@.0.H.....0.2.@.8.:.8.....0.;.0.9.7.8.....>.;.4.0.2.8.....>.=.3.>.;.8.....>.@.2.5.3.8...!.;.>.2.0.:.8...!.;.>.2.5.=.8...".0.=.7.0.=.8...%.>.@.2.0.B.8...-.@.8.B.@.5.9.....2.A.B.@.0.;.8.....2.@.>.1.0.@.B.....=.4.>.=.5.7.8.....0.:.5.4.>.=.8.....5.;.0.=.5.7.8...".C.@.:.<.5.=.8...$.8.=.;.O.=.4.8...(.2.5.9.F.0.@.8...5.2.@.>.7.>.=.0.....5.;.>.@.C.A.A.8.....@.5.=.;.0.=.4.8.....0.;.L.4.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\chr.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6132
                                                                                                                            Entropy (8bit):5.044790248065529
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:pEOOsvtTsvcmPcXlHkHbRhPd3GLbIsqUiVFWvKxJ34UhqppH8nzOB7nMC2F:pxOsVTmRkqzOg2KxJoYqpJ8UM
                                                                                                                            MD5:66D7E7D0CF90CC589AF6D409CA335E60
                                                                                                                            SHA1:B61DD0F92AC35EE5ABDFA6F01C1903E15B36702F
                                                                                                                            SHA-256:131F85262BC6ABBC3021E4DC8BB8D8309D94DE4A2C688F836CBBF30F3F471D30
                                                                                                                            SHA-512:CAF57C274B4B00EB2028BD9607743C540E4F9BCA61C09D3D584C857587FFA728BCE1980432D39885EE4E043FFCFB9DACAC592037CFEE9AE1C6073AA53594B89E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..!.............&......!....5K.y....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\dav.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):984
                                                                                                                            Entropy (8bit):6.664654262645045
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:xmrJVJ7OkJBvWa9D2h1i/veBQ+7TTKO542Kc2hdl/QZ:xMmkXWa9D5HeXTb42SqZ
                                                                                                                            MD5:2DC65410ADD51F24840BE253B3DE1E6A
                                                                                                                            SHA1:555D4E6EB7C777E657DC6FA511950B6A31426BA1
                                                                                                                            SHA-256:E8647FD90A97C6C221DEABE0E4E4F833E3B726C9424091695E2419045D7F2B60
                                                                                                                            SHA-512:01BEC81C93895A11FDB507BCFE01386D0D590E20827AAD4AB59CE50E25DE3074801996FD2B3AC9D8231AF80049DC5ECAAB8E3AD38AE8FD9B4135706CDC53F60F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..........................5K.y..............................................................................................".+...1.7.:.=.@.C.I.L.O.U.X.[.d.g.j.m.s.v.y.|...............................................................................................!.$.'.*.-.0.3.6.?.B.E.H.K.N.T.W.Z.].`.c.f.i.l.o.r.u.x.{.~............................................................................................... .&.).,./.2.5.8.;.>.A.D.G.J.M.P.Y.\._.b.e.h.k.n.q.t.w.z..............h.J.v.2.!.!..u.wo.".?..."....b@M..3E3...2..-!B!i!G...... ...!$!..k./......`......6./"......{h.#.....~.}.....!..U!2........}.v.}.....!...}.._..#....W"."g.%J..M".I2~.......?~.W...Z..`3.)...Ko?..h..XRQ..2.w.}.`pJ...o.@.`Dw.3.3a"7!.!..u".....hAh;3..'w."l....3...".".@..,...x......_!<J..eo_..I..}.....j..3... q.G..w...".o...".".........."."..~!.A.w.3.h....z@[3q3.@..Z.s!D......"%...w...Ww.@.2.}.`.!q.o..v...o$3....O.'..~.R...?..9..". v`dh... .R... ...........P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\de.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3960
                                                                                                                            Entropy (8bit):5.0530028166826595
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:lTzcMNUsLjSZe+iZy0Wq/vZyZnFSp0iLsGJ6ctqppH8nzbd/T+P5wa:lvSaG8qpJ88Pia
                                                                                                                            MD5:DF0C727EB8EDCD974737DD244F7C6520
                                                                                                                            SHA1:72717F9B521311D3F0A0395B4A4189E2F5C691D0
                                                                                                                            SHA-256:2CA5055C02A48C3841F0B67148E2256BFC67B8F42133FB3F2373F8787B7D2998
                                                                                                                            SHA-512:5A8834F667C27D9C7202C392C9B822109252F4B8CD814D7A288451BB0559A83F873973B48B9E5BE9CFE375AFE35E1C6B8BA4EF719774EAB50EB6F50D094B5C30
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .c..............$.....c.....5K.y..W.e.l.t...T...r.k.e.i...Z.y.p.e.r.n...K.o.m.o.r.e.n.....g.y.p.t.e.n...A.l.g.e.r.i.e.n...B.o.l.i.v.i.e.n...N.o.r.w.e.g.e.n...O.s.t.a.s.i.e.n...S.c.h.w.e.d.e.n...S...d.a.s.i.e.n...S...d.s.u.d.a.n...M.a.l.e.d.i.v.e.n.....t.h.i.o.p.i.e.n...C.o.o.k.i.n.s.e.l.n...F.r.a.n.k.r.e.i.c.h.....s.t.e.r.r.e.i.c.h...D.e.u.t.s.c.h.l.a.n.d...K.o.k.o.s.i.n.s.e.l.n...N.i.e.d.e.r.l.a.n.d.e...P.h.i.l.i.p.p.i.n.e.n.....l.a.n.d.i.n.s.e.l.n...G.r.i.e.c.h.e.n.l.a.n.d...K.a.i.m.a.n.i.n.s.e.l.n...L.a.t.e.i.n.a.m.e.r.i.k.a...M.i.t.t.e.l.a.m.e.r.i.k.a...N.e.u.k.a.l.e.d.o.n.i.e.n...E.l.f.e.n.b.e.i.n.k...s.t.e...F.a.l.k.l.a.n.d.i.n.s.e.l.n...M.a.r.s.h.a.l.l.i.n.s.e.l.n...N.o.r.d.m.a.z.e.d.o.n.i.e.n...P.i.t.c.a.i.r.n.i.n.s.e.l.n...W.e.i.h.n.a.c.h.t.s.i.n.s.e.l.....u...e.r.e.s. .O.z.e.a.n.i.e.n...S.u.b.s.a.h.a.r.a.-.A.f.r.i.k.a...S...d.l.i.c.h.e.s. .A.f.r.i.k.a.....q.u.a.t.o.r.i.a.l.g.u.i.n.e.a...B.r.u.n.e.i. .D.a.r.u.s.s.a.l.a.m...E.u.r.o.p...i.s.c.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\de_AT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):92
                                                                                                                            Entropy (8bit):3.2671709230250316
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tluFkC/qql3dsalqhE:Sv6kZSBlqhE
                                                                                                                            MD5:DEF3D8069BB3F45379085CFF1EA1996C
                                                                                                                            SHA1:5D3AB1B6D9A8D7F1AA9DB960CE351D48901EE966
                                                                                                                            SHA-256:28FA3D1D9F85BBC9F344B1770319754341F34237383A73894800D63C4F3B46D0
                                                                                                                            SHA-512:544F0896F423D5B92A4E02A23776F3941F54E6CDE3BBE6453F4580C9E68A61E7B425579A96966B33770D55675E49168A99E6CB8087204EBF0BB4C9E2467B4F4B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..........................5K.y..................P.!.`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\dsb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4156
                                                                                                                            Entropy (8bit):5.016185943974133
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:RnLM+h0LdnBBpTqz/uEqeu60ht8bqpPH8nWnH+E2h:xo+CpK510hyqpv8kah
                                                                                                                            MD5:25164172CFE366C09ADCBA16842F4A8C
                                                                                                                            SHA1:58D494A2C459CEEBC86C1D487120921273375EDC
                                                                                                                            SHA-256:D409AE89C0331168676114AAD6F462CF27FADC3E029FBAC9A8DA88DE7B4C38FB
                                                                                                                            SHA-512:672838A4D90E0C52A2BAFD6D44573A6C255D033D1EE0116C65F4DF5FA5B3D07E7416B1E28D25192E52B95FFFA2365E397C80E9B3D461D259293C6AD9CA9CF469
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .z..............!.....z.....5K.y..s.w...t...R.u.s.k.a...D.a.D.s.k.a...F...r...j.e...N.i.m.s.k.a...P...l.s.k.a...C.h.i.l.s.k.a...I.n.d.i.s.k.a...I.t.a.l.s.k.a...L.e.t.i.s.k.a...L.i.b.y.s.k.a...S.y.r.i.s.k.a...`.p.a.D.s.k.a...`.w.e.d.s.k.a...A.l.b.a.D.s.k.a...A.r.m.e.D.s.k.a...B.e.l.g.i.s.k.a...C.y.p.r.i.s.k.a...E.s.t.n.i.s.k.a...J.a.p.a.D.s.k.a...L.i.t.a.w.s.k.a...R.u.m.u.D.s.k.a...S.a.l.o.m.o.n.y...S.e.r.b.i.s.k.a...S.w.a.s.i.s.k.a...B.u.l.g.a.r.s.k.a...G.r.i.c.h.i.s.k.a...H.u.n.g.o.r.s.k.a...K.a.r.i.b.i.s.k.a...T.u.r.k.o.j.s.k.a...C.a.r.n.a. .G...r.a...E.g.y.p.t.o.j.s.k.a...F.r.a.n.c.o.j.s.k.a...M.a.k.e.d.o.D.s.k.a...S.u.r.i.n.a.m.s.k.a...S.B.o.w.j.e.D.s.k.a...I.n.d.o.n.e.z.i.s.k.a...M.a.w.r.e.t.a.D.s.k.a...G...d.o.w.n.e. .k.u.p.y...S.a.u.d.i.-.A.r.a.b.i.s.k.a...K.a.j.m.a.n.i.s.k.e. .k.u.p.y...s.r.j.e.j.z.n.a. .A.f.r.i.k.a.....e.s.k.a. .r.e.p.u.b.l.i.k.a...M.a.k.e.d.o.D.s.k.a. .(.P.R.J.)...P...d.z.a.j.t.a.n.y. .T.i.m.o.r...S.r.j.e.j.z.n.a. .A.m.e.r.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\el.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8476
                                                                                                                            Entropy (8bit):4.518835379037381
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WhO7Lb3bYnDYxGYND13fatg05W2ai1vzLeG1ZcYaALYHBBEQqpJ8l3y4L:WhKLbCYxbND18g05f9LtKFq844L
                                                                                                                            MD5:B32404B41A7BC39D37EA29C78CD0BF57
                                                                                                                            SHA1:2D3A4547D3CC57FD7FF76335B8FF44003BF679C5
                                                                                                                            SHA-256:77BAF4407E2F8B92AB213C8D905483AC6670AEE91392D7928314523D210B422F
                                                                                                                            SHA-512:9FA15CFD5C2E26EA7C050532E85EC2D6BE4640B2AD89E2F0DB4E681FAA642BE78544B57F7788330DBD0084FEC6FED6B2FF05597A7CA0C49E688BC1F651D20649
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................8.. ........?...?...&.......8...5K.y....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_150.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_AG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_BB.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_BZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_CH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.2778628487696895
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlu1clst0t8tVV1LlUlh+V/91mNJi:SvKclsGt8bHLOl0sNs
                                                                                                                            MD5:425F7078B30F5B06665033F62FECC465
                                                                                                                            SHA1:11D34F02901FDEA72514A99542F69029AFC4030C
                                                                                                                            SHA-256:B4FACD886D586845AB18C1F33F2842BDB4550C002959724A42FE303E5A7EB2A7
                                                                                                                            SHA-512:7A8217E2B5B7998732824D70428DDA3C6C4A77BF333B097778909E8C477B626C27130E22580B6D1C7BEC95A78B1455D3803F73015CD296D759CAA37870A0FD56
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y..2...1...4.8...5.0.............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_CM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_CY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_DM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_GI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_IO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_KI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_KY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_MG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1782170728203383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwMllJ8lvm1Z:Sv9Rvm1Z
                                                                                                                            MD5:7621254D9D701161592F4F0CBBF6F7BF
                                                                                                                            SHA1:D41412336A9893E9A9DD439B13A3C65435018DA3
                                                                                                                            SHA-256:DB13F9C7B55BCCF734F5C6D3C56DFED65EDA9DC7976E24F0A862F2408A6E529F
                                                                                                                            SHA-512:DFE7EACC4058D1862EB6EF8305A388BD27249FE2B91DF08C3102928B066454B322FB55AC7A34DE0E27A87D2112B6A374E674B27B1296240EFE46C5BB135D0A20
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..!....................!....5K.y........a..!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_MY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1376531665973815
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMbEllljq8lvm1g:Sv9Tvm1g
                                                                                                                            MD5:847E775630F25D5D30746D2ABA9615C0
                                                                                                                            SHA1:A538E1D8A5ACDBDEC4C3FE3123A46E6311A466DE
                                                                                                                            SHA-256:4B49D73F1DACC88C3C58BDC9C73014345F9535AD76AF80B72881CA618E0AB804
                                                                                                                            SHA-512:C7A9C62D9EE17004FB9DABAD8B1877D80387692B50447D1CBAF6178CBA89E56FA4272F7292BA9E26BAFA7585C403580093A5E022031F6D0B96E44C7FF4357BCB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.. .................... ....5K.y........a..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_NU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1376531665973815
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMbEllljq8lvm1g:Sv9Tvm1g
                                                                                                                            MD5:847E775630F25D5D30746D2ABA9615C0
                                                                                                                            SHA1:A538E1D8A5ACDBDEC4C3FE3123A46E6311A466DE
                                                                                                                            SHA-256:4B49D73F1DACC88C3C58BDC9C73014345F9535AD76AF80B72881CA618E0AB804
                                                                                                                            SHA-512:C7A9C62D9EE17004FB9DABAD8B1877D80387692B50447D1CBAF6178CBA89E56FA4272F7292BA9E26BAFA7585C403580093A5E022031F6D0B96E44C7FF4357BCB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.. .................... ....5K.y........a..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_NZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.178217072820338
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM/llCy8lvm1H:Svhlvm1H
                                                                                                                            MD5:558E0FDA40BF93F5445F09E14F2ACC09
                                                                                                                            SHA1:FD9E71B80869C8BC7870FD2946D2C3B84EBA5E0C
                                                                                                                            SHA-256:CDF68F3DA7C805CC6792BA6A17654EB87E429F01BE96957FB2F468444E334D4C
                                                                                                                            SHA-512:46DFC8C70742851B726EF03359880D49371A03F9264BDF4E7B5A0C47DA978EF19C8034DD2D56BFAFCD6329713F8EA40077535BB4BAD4FBE942CF7830FA7BBE6F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.*#...................*#....5K.y........a.)#

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_PN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1376531665973815
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMbEllljq8lvm1g:Sv9Tvm1g
                                                                                                                            MD5:847E775630F25D5D30746D2ABA9615C0
                                                                                                                            SHA1:A538E1D8A5ACDBDEC4C3FE3123A46E6311A466DE
                                                                                                                            SHA-256:4B49D73F1DACC88C3C58BDC9C73014345F9535AD76AF80B72881CA618E0AB804
                                                                                                                            SHA-512:C7A9C62D9EE17004FB9DABAD8B1877D80387692B50447D1CBAF6178CBA89E56FA4272F7292BA9E26BAFA7585C403580093A5E022031F6D0B96E44C7FF4357BCB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.. .................... ....5K.y........a..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_PW.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1376531665973815
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMbEllljq8lvm1g:Sv9Tvm1g
                                                                                                                            MD5:847E775630F25D5D30746D2ABA9615C0
                                                                                                                            SHA1:A538E1D8A5ACDBDEC4C3FE3123A46E6311A466DE
                                                                                                                            SHA-256:4B49D73F1DACC88C3C58BDC9C73014345F9535AD76AF80B72881CA618E0AB804
                                                                                                                            SHA-512:C7A9C62D9EE17004FB9DABAD8B1877D80387692B50447D1CBAF6178CBA89E56FA4272F7292BA9E26BAFA7585C403580093A5E022031F6D0B96E44C7FF4357BCB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.. .................... ....5K.y........a..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_RH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.7148996570578574
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlKelBjlgljl/k8ALlQpo:SBtkJTl4Kl2o
                                                                                                                            MD5:12BE3D5BB9B96E2BE6DA7B2DD273699A
                                                                                                                            SHA1:3A4556BD049B2C67A408A789DB6812780D606332
                                                                                                                            SHA-256:D8D507E53D278D6B3F9322121CD46D54D9629FF946869C8D4CD941F0F777C2A6
                                                                                                                            SHA-512:B7FACCFB049ECF7EA5B9C93274A3B9B2E6AB894EAC0099D72150BD31401356179A2A5E6DCB0650958F567D586F67CCD768FA78C6D40DF3229FDE0498ACB29F55
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y..e.n._.Z.W.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_SC.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1376531665973815
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMbEllljq8lvm1g:Sv9Tvm1g
                                                                                                                            MD5:847E775630F25D5D30746D2ABA9615C0
                                                                                                                            SHA1:A538E1D8A5ACDBDEC4C3FE3123A46E6311A466DE
                                                                                                                            SHA-256:4B49D73F1DACC88C3C58BDC9C73014345F9535AD76AF80B72881CA618E0AB804
                                                                                                                            SHA-512:C7A9C62D9EE17004FB9DABAD8B1877D80387692B50447D1CBAF6178CBA89E56FA4272F7292BA9E26BAFA7585C403580093A5E022031F6D0B96E44C7FF4357BCB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.. .................... ....5K.y........a..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_SG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1376531665973815
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMbEllljq8lvm1g:Sv9Tvm1g
                                                                                                                            MD5:847E775630F25D5D30746D2ABA9615C0
                                                                                                                            SHA1:A538E1D8A5ACDBDEC4C3FE3123A46E6311A466DE
                                                                                                                            SHA-256:4B49D73F1DACC88C3C58BDC9C73014345F9535AD76AF80B72881CA618E0AB804
                                                                                                                            SHA-512:C7A9C62D9EE17004FB9DABAD8B1877D80387692B50447D1CBAF6178CBA89E56FA4272F7292BA9E26BAFA7585C403580093A5E022031F6D0B96E44C7FF4357BCB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.. .................... ....5K.y........a..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_TT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1376531665973815
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMbEllljq8lvm1g:Sv9Tvm1g
                                                                                                                            MD5:847E775630F25D5D30746D2ABA9615C0
                                                                                                                            SHA1:A538E1D8A5ACDBDEC4C3FE3123A46E6311A466DE
                                                                                                                            SHA-256:4B49D73F1DACC88C3C58BDC9C73014345F9535AD76AF80B72881CA618E0AB804
                                                                                                                            SHA-512:C7A9C62D9EE17004FB9DABAD8B1877D80387692B50447D1CBAF6178CBA89E56FA4272F7292BA9E26BAFA7585C403580093A5E022031F6D0B96E44C7FF4357BCB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.. .................... ....5K.y........a..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_TV.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1376531665973815
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMbEllljq8lvm1g:Sv9Tvm1g
                                                                                                                            MD5:847E775630F25D5D30746D2ABA9615C0
                                                                                                                            SHA1:A538E1D8A5ACDBDEC4C3FE3123A46E6311A466DE
                                                                                                                            SHA-256:4B49D73F1DACC88C3C58BDC9C73014345F9535AD76AF80B72881CA618E0AB804
                                                                                                                            SHA-512:C7A9C62D9EE17004FB9DABAD8B1877D80387692B50447D1CBAF6178CBA89E56FA4272F7292BA9E26BAFA7585C403580093A5E022031F6D0B96E44C7FF4357BCB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.. .................... ....5K.y........a..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_VU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1376531665973815
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMbEllljq8lvm1g:Sv9Tvm1g
                                                                                                                            MD5:847E775630F25D5D30746D2ABA9615C0
                                                                                                                            SHA1:A538E1D8A5ACDBDEC4C3FE3123A46E6311A466DE
                                                                                                                            SHA-256:4B49D73F1DACC88C3C58BDC9C73014345F9535AD76AF80B72881CA618E0AB804
                                                                                                                            SHA-512:C7A9C62D9EE17004FB9DABAD8B1877D80387692B50447D1CBAF6178CBA89E56FA4272F7292BA9E26BAFA7585C403580093A5E022031F6D0B96E44C7FF4357BCB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.. .................... ....5K.y........a..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_ZM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.1376531665973815
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMbEllljq8lvm1g:Sv9Tvm1g
                                                                                                                            MD5:847E775630F25D5D30746D2ABA9615C0
                                                                                                                            SHA1:A538E1D8A5ACDBDEC4C3FE3123A46E6311A466DE
                                                                                                                            SHA-256:4B49D73F1DACC88C3C58BDC9C73014345F9535AD76AF80B72881CA618E0AB804
                                                                                                                            SHA-512:C7A9C62D9EE17004FB9DABAD8B1877D80387692B50447D1CBAF6178CBA89E56FA4272F7292BA9E26BAFA7585C403580093A5E022031F6D0B96E44C7FF4357BCB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.. .................... ....5K.y........a..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\eo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5384
                                                                                                                            Entropy (8bit):4.242133896275624
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:+q34wFWjpAlhpy3wVbTUx+5kb5fX93jXQgTge9DsWwiO54pI8:+laUp3gVcxxJXZlwWI8
                                                                                                                            MD5:98528308F1FBAEFA8C3B0FB33504D201
                                                                                                                            SHA1:FD88A585EA8127FD54455FF6D9200EC326643542
                                                                                                                            SHA-256:E5E971CB075C187954AABDD790B9C86B620A9DECA9AB7BC5D95ED401C4B6A789
                                                                                                                            SHA-512:5DBAC04412DA84E6E8EB03192257C7A7F87169F60E0CA84EF278FF4A2271249BBC3C9BF7BDFF04B6E0763836AEC137F1229B5F1F80F081BC175A67B7BC0BAE8D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................6.. .......:...:..........6...5K.y..K.u.b.o...N.i.u.o.....a.d.o...A.r.u.b.o...F.i...o.j...G.a.n.a.o...G.v.a.m.o...I.r.a.k.o...I.r.a.n.o...K.e.n.j.o...K.i.p.r.o...L.a.o.s.o...L.i.b.i.o...M.a.l.i.o...M.a.l.t.o...M.o.n.d.o...N.a.u.r.o...O.m.a.n.o...P.e.r.u.o...S.a.m.o.o...S.i.r.i.o...T.o.n.g.o...U.s.o.n.o.....i.l.i.o...A.n.d.o.r.o...A.n.g.o.l.o...B.e.l.a.m.o...B.e.l.i.z.o...B.e.n.i.n.o...B.u.t.a.n.o...D.a.n.u.j.o...F.e.r.o.o.j...G.a.b.o.n.o...G.a.m.b.i.o...G.u.j.a.n.o...H.a.i.t.i.o...J.e.m.e.n.o...K.a.n.a.d.o...K.a.t.a.r.o...M.a.j.o.t.o...N.i...e.r.o...P.a.n.a.m.o...R.e.u.n.i.o...R.u.a.n.d.o...R.u.s.u.j.o...S.u.d.a.n.o...T.o.g.o.l.o...T.u.v.a.l.o...U.g.a.n.d.o...Z.a.m.b.i.o.....e.%.u.j.o.....i.n.u.j.o...A.l...e.r.i.o...A.n.g.v.i.l.o...B.a.h.a.m.o.j...B.a.r.b.a.d.o...B.a.r.e.j.n.o...B.e.l.g.u.j.o...B.o.c.v.a.n.o...B.o.l.i.v.i.o...B.r.a.z.i.l.o...B.r.u.n.e.j.o...B.u.r.k.i.n.o...B.u.r.u.n.d.o...D.o.m.i.n.g.o...E.r.i.t.r.e.o...G.r.e.k.u.j.o...G.r.e.n.a.d.o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\es.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2728
                                                                                                                            Entropy (8bit):5.60522054715822
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:EWYU030ufLAfsS/f2S0XIXQA8Bhn9hhwQUCfpJNnqpZXXZJ8HHzHH7hiWVZGj30o:Kkd6OgbBhbLfqppH8nzbhiWV4b0Vdf7c
                                                                                                                            MD5:C14DCD32E8D42B8370097C12830ECB57
                                                                                                                            SHA1:CF0E293A0E96C09326DED5F34BFF1FC93AED6BB4
                                                                                                                            SHA-256:5CE6979AF3C70651590A24EC3CEE816A344FCF8600B8D271E181A1C36C37D86F
                                                                                                                            SHA-512:7D3EC5A047E5817EC850B8F86CE54F7E00196762A8FC6418122ACF2F2A0F1336490B9D8882029A52FB14439240B6F414DDE844FD855C6641BC13EEDAA85FFC21
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................$...........5K.y..F.i.y.i...J.a.p...n...T...n.e.z...B.a.r...i.n...B.e.l.i.c.e...Y.i.b.u.t.i...A.r.g.e.l.i.a...C.u.r.a.z.a.o...R.u.m.a.n...a...U.c.r.a.n.i.a...C.a.n.a.r.i.a.s...E.s.u.a.t.i.n.i...P.a.k.i.s.t...n...B.a.n.g.l.a.d...s...I.s.l.a.s. .C.o.o.k...S.u.d.a.m...r.i.c.a...I.s.l.a. .B.o.u.v.e.t...I.s.l.a. .d.e. .M.a.n...I.s.l.a.s. .F.e.r.o.e...I.s.l.a.s. ...l.a.n.d...S.a.n.t.a. .E.l.e.n.a...I.s.l.a.s. .C.a.i.m...n...C.e.n.t.r.o.a.m...r.i.c.a...I.s.l.a.s. .S.a.l.o.m...n...L.a.t.i.n.o.a.m...r.i.c.a...I.s.l.a.s. .M.a.l.v.i.n.a.s.....f.r.i.c.a. .c.e.n.t.r.a.l...I.s.l.a. .C.l.i.p.p.e.r.t.o.n...I.s.l.a. .d.e. .N.a.v.i.d.a.d...N.a.c.i.o.n.e.s. .U.n.i.d.a.s...G.u.a.y.a.n.a. .F.r.a.n.c.e.s.a...M.a.c.e.d.o.n.i.a. .(.E.R.Y.M.)...C.o.n.g.o. .(.R.e.p...b.l.i.c.a.)...R.e.g.i...n. .d.e.s.c.o.n.o.c.i.d.a...C.i.u.d.a.d. .d.e.l. .V.a.t.i.c.a.n.o...R.A.E. .d.e. .M.a.c.a.o. .(.C.h.i.n.a.)...S.v.a.l.b.a.r.d. .y. .J.a.n. .M.a.y.e.n...I.s.l.a.s. .T.u.r.c.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\es_CO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):128
                                                                                                                            Entropy (8bit):4.0106388429862925
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlEFU/glo7BgTlRP2OcqVA6e4PoY/ef:Sv8U/go7wlp2O3Xq3f
                                                                                                                            MD5:23FF1E45B7F45B8C1CDF06E183359019
                                                                                                                            SHA1:34A374D2661E3E7620A680A3EB08AC3015C15645
                                                                                                                            SHA-256:70DA312294D03A617A82BA66B202FAF9013C1D75899BC4FABAFA3F584CE84FBA
                                                                                                                            SHA-512:F9574D339FC5C258E36C3C6B85CDCF7BB18105547205C7D6A8640126F5DCC23F63B38B0998CE1E7B5311A0C846567C905447CC7FDDC33D71A2448E70D7A8110D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................5K.y........2.S.n.p.jh.Q......y....................`...P...P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\es_CR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):124
                                                                                                                            Entropy (8bit):3.8643215884156596
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tldS/mmJ7lNzwd0OkGtl36e4Poe9gF:Sv0/mmRw2OJKq5
                                                                                                                            MD5:DF8C1B6C2E9D796CC17FDC48CDE3CB5F
                                                                                                                            SHA1:6B58526E194EB5461EB52568711CF490FC6CE325
                                                                                                                            SHA-256:6423A955DC8A45912DC4CA81AAA6EDE3554C2DAD3EFE200FF97428EC88995DA0
                                                                                                                            SHA-512:7C8085034258EBACDA4948E6FCEBCE0F4D9B56DA4FC6377E4CC94B042FC54F9F775D93D6EFBD9877D9E453C9C31876F905E8953298C71C37CF720DEE2FEF9DB2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................5K.y........2.S.p.jh.Q....y....................`...P...P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\es_PA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):124
                                                                                                                            Entropy (8bit):3.8643215884156596
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tldS/mmJ7lNzwd0OkGtl36e4Poe9gF:Sv0/mmRw2OJKq5
                                                                                                                            MD5:DF8C1B6C2E9D796CC17FDC48CDE3CB5F
                                                                                                                            SHA1:6B58526E194EB5461EB52568711CF490FC6CE325
                                                                                                                            SHA-256:6423A955DC8A45912DC4CA81AAA6EDE3554C2DAD3EFE200FF97428EC88995DA0
                                                                                                                            SHA-512:7C8085034258EBACDA4948E6FCEBCE0F4D9B56DA4FC6377E4CC94B042FC54F9F775D93D6EFBD9877D9E453C9C31876F905E8953298C71C37CF720DEE2FEF9DB2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................5K.y........2.S.p.jh.Q....y....................`...P...P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\eu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5404
                                                                                                                            Entropy (8bit):4.578439940354441
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:SXjLsIJwCDfQTlHAGxZz8FK1EKdDELXpemPutAdqppH8nzb0hHPjNxGV5JvT:EMIJJoTVlZAFvpeKqpJ8sdPjPGvT
                                                                                                                            MD5:AA5B93E87201E9BC7D60A49500C120D5
                                                                                                                            SHA1:866C65836AB4B81286A9C9D2977525D22EDED8B7
                                                                                                                            SHA-256:61C1D44AD67600EDF24B3616C3DBEDE66FF4C3CC9F297FB911D3C056D684E8EA
                                                                                                                            SHA-512:E233D5C0B0EFDCD22DE81F7E042D676A60B0A1F2DB95B21685542673C60343CD52D072294011B0CD9A051741E5A0C74F301CF16DAF0F4CAB8CAB0F6710344472
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................8.. .0......?...?...$.....0.8...5K.y..C.I...T.x.a.d...T.x.i.l.e...T.x.i.n.a...Z.i.p.r.e...G.r.e.z.i.a...M.u.n.d.u.a...S.u.e.d.i.a...S.u.i.t.z.a...T.x.e.k.i.a...A.i.n.g.i.r.a...B.a.h.a.m.a.k...B.e.l.g.i.k.a...E.r.r.u.s.i.a...K.a.r.i.b.e.a...K.r.o.a.z.i.a...E.s.p.a.i.n.i.a...F.r.a.n.t.z.i.a...K.a.n.a.r.i.a.k...K.a.n.b.o.d.i.a...K.o.l.o.n.b.i.a...K.o.m.o.r.e.a.k...M.a.l.d.i.v.a.k...M.a.u.r.i.z.i.o...E.r.r.u.m.a.n.i.a...E.s.l.o.v.a.k.i.a...E.u.r.o.g.u.n.e.a...F.i.l.i.p.i.n.a.k...M.a.z.e.d.o.n.i.a...M.o.z.a.m.b.i.k.e...B.o.l.i. .K.o.s.t.a...F.a.l.k.l.a.n.d.a.k...H.e.g.o. .K.o.r.e.a...H.e.g.o. .S.u.d.a.n...H.e.g.o.a.f.r.i.k.a...I.p.a.r. .K.o.r.e.a...K.o.n.g.o. .(.D.R.)...L.u.x.e.n.b.u.r.g.o...S.a.n. .M.a.r.t.i.n...M.a.n. .u.h.a.r.t.e.a...S.a.n.t.a. .L.u.z.i.a...S.e.y.c.h.e.l.l.e.a.k...H.e.g.o. .A.m.e.r.i.k.a...I.p.a.r. .A.m.e.r.i.k.a...N.a.z.i.o. .B.a.t.u.a.k...A.s.i.a. .e.k.i.a.l.d.e.a...C.o.o.k. .u.h.a.r.t.e.a.k...L.a.t.i.n.o.a.m.e.r.i.k.a...A.s.i.a. .e.r.d.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\fa.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5828
                                                                                                                            Entropy (8bit):4.714886250548154
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:IMcfQynIgD52g/jk9vCKeXSwj1DsRM3r+HkLUqppH8nzb4znli5IX:IAynI652X96+RMKHkLUqpJ8+nI5IX
                                                                                                                            MD5:24089A0D9EAA78C1AD8E02AD7ACEE3C7
                                                                                                                            SHA1:AFD0C33AE4285C95DE0C248EBA5374F608ABB799
                                                                                                                            SHA-256:A36815C3A7108C8E95357A448FD6EEBEC3734933B22D6C496A6716029BFE06FC
                                                                                                                            SHA-512:EE148F7B4986F5A08A990055B45B6931F63CA621F5190D2FC287B8DFFDE61E93ACADFA963B98B7DC4D9EDD50B4E7646AC5AF07294B139BB02845FF874E03CDE3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .6..............$.....6.....5K.y..:.F.'...~.1.H...(.F...F...,.1.2.....,.G.'.F...3.H.&./...3...4.D...4...D.....D...(.....E.'.D.*...F.1.H.....F.~.'.D.....'.~.F.....F...'.....H.(.'.....'.(.F.......F.G...(.1.2...D...(.D.........*.1.....G...3.'.E.H."...3.F...'.D...3.H.&...3...3.H./.'.F...D.*.H.F.....E.'.D.2.....E.'...H.*...E.H.1...3...E...2.......F...H.&.G.....H.2.H.H.....H.E.H.1.....1.F.2.......H...'.F...".D.(.'.F.....".F./.H.1.'...".F...H.D.'...'.*...H.~.....'.3.*.H.F.....'...1.D.F./...'...3.D.F./...(.'.G.'.E.'...(.1.H.F.&.....(.D.'.1.H.3...(.H.D...H.....*.'...D.F./...*.H.H.'.D.H...,...(.H.*.....1.H.'.F./.'...1.H.E.'.F.....3.H.E.'.D.....A.F.D.'.F./...D.G.3.*.'.F...D...(.1...'...E.'.D./...H...E.'...'.&.H...E.D.'.F.2.....F...,.1...G...G.'.&...*.....~.'.D.'.&.H...~.1.*.:.'.D.....'.E.(.H.,.....'.F.'./.'.....1.H.'.3.......D.E.(...'.....1.F.'./.'...".F...H...D.'...'.1.H...H.&.G...'.3.1.'.&...D...'.3.D.H.'.......'.3.D.H.H.F.....'.3.~.'.F...'...'.D.,.2.'...1...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ff.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5156
                                                                                                                            Entropy (8bit):4.251772609765763
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:nAThdY+tbd/q98SkZ7M6XUgLuH9y0DbhiNvP438wRA+mwiisgtjHLgJb0kXF9D5y:nGY+tc98SkZ7DXhKH97hiNvPG80A+IiZ
                                                                                                                            MD5:34122262DC803793983D52A11C615FDA
                                                                                                                            SHA1:492D2CB109D6C4A7E702BE1D98648EE4BB8BD7CD
                                                                                                                            SHA-256:1D0ECD0E39D703CC42CADC71DF42DA24F217264C5F16BA650CF0B256A7A4F466
                                                                                                                            SHA-512:9525D2068DB493577999BA3ED3894A434002000DF6420C9B658065410793E1FEA7551BC846FEF2FB869758E1EA5DA469A518B2DB4512022A4A9FA1CEF1BFBF78
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................5K.y..C.a.a.d...B.e.n.e.e...C.i.l.i.i...E.j.i.p.t...E.n.n.d.o...F.i.j.j.i...G.a.b.o.o...G.a.n.a.a...G.u.w.a.m...K.e...a.a...K.u.b.a.a...L.i.b.a.a...M.a.l.t.e...M.a.r.u.k...N.i.u.w.e...P.o.l.o.....S.a.p.o.o...S.i.r.i.i...T.o.g.o.o...B.e.l.j.i.k...B.u.t.a.a.n...E.c.o.p.p.i...E.s.p.a.a.....G.a.m.m.b.i...G.e.r.e.e.s...G.i.y.a.a.n...H.a.y.t.i.i...L.a.w.o.o.s...M.a.y.o.o.t...M.e.k.s.i.k...M.o.r.i.i.s...N.e.p.a.a.l...N.i.j.e.e.r...R.i.i.s.i.i...S.a.m.m.b.i...S.e.y.s.e.l...S.i.i.p.a.r...S.u.d.a.a.n...S.u.w.e.e.d...S.u.w.i.i.s...T.u.r.k.i.i...A.l.a.s.e.r.i...A.l.b.a.n.i.i...A.r.m.e.n.i.i...B.a.h.r.e.y.n...B.e.l.i.i.s.e...B.o.l.i.w.i.i...B.u.r.n.a.a.y...F.e.n.l.a.n.d...G.a.r.n.a.a.d...J.a.m.a.y.k.a...J.e.o.r.g.i.i...J.i.b.u.t.i.i...J.o.r.d.a.n.i...K.a.n.a.d.a.a...K.u.w.e.y.t.i...L.e.t.o.n.i.i...M.a.l.e.s.i.i...N.a.m.i.b.i.i...N.o.r.w.e.e.s...O.n.n.g.i.r.i...O.t.i.r.i.i.s...P.a.n.a.m.a.a...R.e.w.i...o.o...R.u.m.a.n.i.i...S.a.m.o.w.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ff_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9159246284584364
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMAt66E7lol1Bsnn:SvHt66goDq
                                                                                                                            MD5:A0838E6D15B5072DC03BAEB7F98ED41A
                                                                                                                            SHA1:98AB23737463E55ADA302D75545A9BB32BE19272
                                                                                                                            SHA-256:825E5F4187683FE01E0FFF595D7CB7CAB8654C5699F0D8386E6C3625A5E3B19F
                                                                                                                            SHA-512:B4F64FA488F5AF2465E5F986C7B505DF49C23166C022E13DBE764047833735551F67C2F3DACDFFF46A30847E8303DF96270471F990AC48353E6A5BAACAFC3D2A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.. .................... ....5K.y.......

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ff_Latn_GN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/dsp:SBtkJ1li6gml/8
                                                                                                                            MD5:3F209B3AA35603DCBB208A74CAA36C86
                                                                                                                            SHA1:249DE057005BE697205333ABA0433C5B04653BBB
                                                                                                                            SHA-256:F3965E339C622C96879DEE316DE42F9E9F693DDEB7A52FDCEBBA027171F2C86A
                                                                                                                            SHA-512:02411AE5728814057E0CA78D850EEA85B3ACA16DFDBEE97A7C01860DA3B82640EEBE60960938C7F64B05D9E9FE8BAE0B826D242E24B33C40024836F716F17E31
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\fr_BE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):176
                                                                                                                            Entropy (8bit):3.5291796110164784
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tldFnsllllFxJlzlFlbiYZfUfC0faLkgBIlFUfC0/H24E83lqQt:Sv3MrJZZVZsfaITlFUf24R38Qt
                                                                                                                            MD5:1A3462FEC297B2C16F431412597054F7
                                                                                                                            SHA1:5F64484F8A239947F3342543A56DC75B21794B66
                                                                                                                            SHA-256:A384B7D7029CDF47B70D23110B710D332E117E6FEA9BE44ED331FB54E0B61105
                                                                                                                            SHA-512:153B73F97468E705286D0FF7D9B391A4EC1DBD3972DA1F1502A18ECC2424F4B3E860913D03391CE374DA1E144C631D2474306A4A300EF503B6554642CAD31473
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................ .. .C!.....$...$.........C! ...5K.y....l.e.s. .G...o.r.g.i.e. .d.u. .S.u.d. .e.t. .S.a.n.d.w.i.c.h. .d.u. .S.u.d.........B!D!..........(..P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\gd.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9100
                                                                                                                            Entropy (8bit):4.109836759452686
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:7uZ267GlZYl+oV6Xsi+626PCAUTI3ifXqpJ89CezL:7uZGDYl+lXsL623AU5vq89Ce/
                                                                                                                            MD5:282EF635F3BD6E8FBCFCF5D73C7BFD69
                                                                                                                            SHA1:6F8B12533ED59E55FB32F5800AFFA4BCE44F3C83
                                                                                                                            SHA-256:DDDDB61FDEAA80A7571BE1679CDE4C1E5596A7DAED657D9A583F4BEF6BF2FE01
                                                                                                                            SHA-512:894DFA667F6E347BB5A7B278EB00DC124DC03ADF3E666E30B586A3D068E314CD313DA365AD59652DE6BF8C42AB91B47B43B139D926503155E670C6F51A4AFF7D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .9..............$.....9.....5K.y..R.A...C...b.a...F...d.i...G...n.a...O.m...n...A.r...b.a...B.u.t...n...I.o.r...c...I.o.r...n...M...i.l.i...P.e.a.r.....S.u.d...n...A.n.g...l.a...B.e.i.n.i.n...C.e.i.n.i.a...C.o.i.r...a...E.a.r.t.r.a...I...r.d.a.n...L.i.b...i.r...L...t.h.o.s...M.o.r.o.c.o...N.a.b.h.r.u...N.e.a.p...l...N...g.e.i.r...P.a.l.a.b.h.....i.r.i.n.n...A.n. .R.u.i.s...B.r.a.i.s.i.l...C.a.m.a.r.u.n...C...o.p.r.a.s...H.a.i.d.h.t.i...I.o.s.r.a.e.l...L.e.a.s.o.t.o...M.a.c...t.h.u...M.i...n.m.a.r...S.a.m.o.t.h.a...S.u.r.a.n.a.m...S...i.m.b.i.a...T.u.b.h.a.l.u...A.i.l.d.i.r.i.a...A.l.b...i.n.i.a...A.n. .E.a.m.a.n...A.n. .I.t.i.o.p...A.n. .T.u.i.r.c...A.n. .t.-.S...n...B.a.c.h.r.a.i.n...B.e.a.r.m...d.a...B.r...n.a.i.g.h...C.i.r.i.b.e.a.s...C.u.i.b.h...i.t...D.i.a.m.e.u.g.a...E.a.c.u.a.d.o.r...G.r.e.a.n...d.a...G.u.a.d.a.l.u.p...H.o.n.d...r.a.s...L.e.a.b.a.n.o.n...M.e.a.g.s.a.g.o...N.i.g...i.r.i.a...P.a.g.a.s.t...n...R.o.m...i.n.i.a...R.u.b.h.a.n.d.a...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\gsw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6328
                                                                                                                            Entropy (8bit):4.404428572830834
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:3iSCgOFoYpnCF4F1EwQkfsk8mhcfhuRNBs8e8Rn:3xsFoUnO4F1EwhUkFqfh+NKx81
                                                                                                                            MD5:98AD672586E6D840D2E1F903F6838857
                                                                                                                            SHA1:5D2DE185390D877CA6738CDEED7DAAC00AA8FAEC
                                                                                                                            SHA-256:E7F66CA60655C291257B10EAD74E9F6EF964BCF726A3D57FF82229DBB9D06CFB
                                                                                                                            SHA-512:8EF1F94EF329FFB902709D9A48ABA711E30D18877969EAEACE38E3B5B8674D92C0F4859CCD20BBA48C2446C5683B999838DAC76230CB621B06C672B38A1B5C7D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .0......&...&.........0.....5K.y..W...l.t...A.a.s.i.e...J.e.e.m.e...L.a.a.o.s...P.o.o.l.e...T.o.o.g.o...C.h.i.i.n.a...G.g.a.t.a.r...G.i.n.e.e.a...K.e.e.n.i.a...K.u.w...i.t...L.....b.i.e...M.a.j.o.t.t...S.a.m.o.o.a...S...r.b.i.e...S.....r.i.e...Z.y.p.e.r.e.....g...p.t.e...E.u.r.o.o.p.a...F.i.t.s.c.h.i...G.....r.n.s.i...I.t.a.a.l.i.e...K.o.m.o.o.r.e...L.e.s.o.o.t.o...L.i.t.t.a.u.e...S.c.h.w.i.i.z...T.s.c.h.i.l.e...T...r.g.g.e.i...W.i.e.t.n.a.m...A.l.b.a.a.n.i.e...A.l.g.e.e.r.i.e...A.r.m.e.e.n.i.e...B.a.c.h.r...i.n...B.a.h.a.a.m.a.s...B.e.r.m.u.u.d.a...B.o.l.i.i.v.i.e...B.r.a.s.i.l.i.e...D.s.c.h...r.s.i...E.e.s.t.l.a.n.d...G.e.o.o.r.g.i.e...G.u.a.d...l.u.p...K.r.o.a.a.z.i.e...L.i.b.e.e.r.i.a...M.a.l...i.s.i.a...N.a.m.i.i.b.i.a...N.i.g.e.e.r.i.a...N.o.r.w.e.e.g.e...R.e...n.i.o.o.n...R.u.m.....n.i.e...S.c.h.p.a.n.i.e...S.c.h.w.e.e.d.e...S.l.o.w.a.k...i...S.o.m.a.a.l.i.e...T.o.m.i.n.i.c.a...T.u.n.e.e.s.i.e...T...n.e.m.a.r.k...U.k.r.a.i.i.n.e.....r.i.t.r.e.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\gu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8168
                                                                                                                            Entropy (8bit):4.603147322781166
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:ynPbwZCbJ4ocfZAA6crroWqz8mDoJDAYgqpJ8GHl/GOsY:yPcZkJzvcnNaeMYgq80B
                                                                                                                            MD5:87C78D1DDED3E5D2989F06A7E2A03D3E
                                                                                                                            SHA1:66D8D13763AC9AE97B1AF622245799DD3FC68DA1
                                                                                                                            SHA-256:39C5A4BFA961A082D2B43D46B8ED1EC5C9B7966BD9023715BEFEB8BBF6F9090D
                                                                                                                            SHA-512:B7A8234A5010168B92FA785E4622BC769C1EE6A78AFB23FF37AD7CAF495AFF2B940EAA7B33CBBDD5C6DAD16EBF67BECA71897EA5D775E512AA7B63BFE1B38552
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..!.............$......!....5K.y....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\is.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):7156
                                                                                                                            Entropy (8bit):4.395054498069301
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:9I6aIJRhl/hzSrOK77dWbfK7xevyGjyQrnUjJ0JbTm0INwRqppH8nzb5YPKqLF:O67RhLzsdWMGyGjPrU4QqRqpJ8xYPKqh
                                                                                                                            MD5:881EE7330ACCAF45638EA4108DE598A8
                                                                                                                            SHA1:7A645D5FE2D1AC5E744FE8DA55C02D462878E34F
                                                                                                                            SHA-256:88A3250FEEE3C95AB54275107965BDC80B4665DF37BFEC1C6771C33A26E19397
                                                                                                                            SHA-512:775A64ADB24F5B35585FAEC7AD22867CC2F4C3145B05F25E1CFDFD3D191B99A67F9B6D909A0B0927ABFC2045914512C485A8BA3C2866C8D1B18522B41EB7206B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..z.............$......z....5K.y..S.....B.N.A...M...n...G.v.a.m...K...n.a...K...b.a...N...r.....P.a.l.....S...l.e...T...g.......r.a.k.....r.a.n.....m.a.n...A.l.s...r...B.e.l...s...B...t.a.n...H.a...t.....K.e.n...a...K...p.u.r...L...b...a...S.p...n.n...S.v.i.s.s...T...n.i.s...B.a.r.e.i.n...B.e.l.g...a...B.r...n.e.i...G.a.m.b...a...J...l.a.e.y...K...s...v.....K...v.e.i.t...L.e.s...t.....M.a.l.a.v.....M.e.x...k.....M...n.a.k.....R...a.n.d.a...S.a.m.b...a...S.e.r.b...a...T.a...v.a.n...T...k.e.l.....T...v.a.l.......r.l.a.n.d.....s.l.a.n.d.....s.r.a.e.l.....t.a.l...a.....g.a.n.d.a.....r...g.v.....A.l.b.a.n...a...A.r.m.e.n...a...B...l.i.v...a...B...r...n.d.....D.a.n.m...r.k...D.j...b...t.....E.r...t.r.e.a...E.......p...a...G.e.o.r.g...a...I.n.d.l.a.n.d...J.a.m.a...k.a...K.a.m.e.r...n...K.r...a.t...a...L.i.t.h...e.n...L...b.a.n.o.n...L...b.e.r...a...M.a.l.a.s...a...M.a.r.o.k.k.....M.o.l.d...v.a...N.a.m.i.b...a...N.o.r.e.g.u.r...N...g.e.r...a...P.a.r.a.g.v...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ka.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8796
                                                                                                                            Entropy (8bit):4.344872386253866
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:Ck6GvXwfWPke7c7+YtHonWgkGlyM/07oh/qpJ8eXKsT:P6GvXwfWPXg7fLoq8elT
                                                                                                                            MD5:BCBB34B1BBF4DDF1C23E844C621BF732
                                                                                                                            SHA1:65CC9E894F3B35BD3320EEAB304A08AD74BF451F
                                                                                                                            SHA-256:B3EF2DFDBED3700A66966801B53C08C946A51A298E1866EF4ADC0D4E8D9E11E5
                                                                                                                            SHA-512:7CA9D438CBA068DA2FD451E2B849E6037904CDD6C2C6FDA098D6E2D943A1013041D99F2A2B803344A788DB1A55A5A4EA68EA2473A386548E785786225C59F7B7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..!.............$......!....5K.y....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\kln.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8556
                                                                                                                            Entropy (8bit):3.8572651947001155
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:K+rST6GPB2Io0rVZVm1k1iQBqo0ySEsQfFRcba:BEbBI9k1ekJRcO
                                                                                                                            MD5:A96491F615F7809E5C2F36A46D85AFD2
                                                                                                                            SHA1:2ED9AB53CC57CAF5FF72000D8011EE11A06ED273
                                                                                                                            SHA-256:8388B553E2EB3AB9F8C786C2B15130DE9D4BBFDC6C547EC16EB4ED3D9055C854
                                                                                                                            SHA-512:9C07B0B489D0887102A3D6B06B885433AF9504467B82DA2137C4C188BF42D385733958E8164C4EB1BF845941CF926ECBE9265DAB8CF47C31225D6A553560D4E0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................O.. ........S...S...........O...5K.y..E.m.e.t.a.b. .C.h.a.d...E.m.e.t.a.b. .C.u.b.a...E.m.e.t.a.b. .F.i.j.i...E.m.e.t.a.b. .G.u.a.m...E.m.e.t.a.b. .I.r.a.n...E.m.e.t.a.b. .I.r.a.q...E.m.e.t.a.b. .L.a.o.s...E.m.e.t.a.b. .M.a.l.i...E.m.e.t.a.b. .N.i.u.e...E.m.e.t.a.b. .O.m.a.n...E.m.e.t.a.b. .P.e.r.u...E.m.e.t.a.b. .T.o.g.o...E.m.e.t.a.b. .A.r.u.b.a...E.m.e.t.a.b. .B.e.n.i.n...E.m.e.t.a.b. .C.h.i.l.e...E.m.e.t.a.b. .C.h.i.n.a...E.m.e.t.a.b. .G.a.b.o.n...E.m.e.t.a.b. .G.h.a.n.a...E.m.e.t.a.b. .H.a.i.t.i...E.m.e.t.a.b. .I.n.d.i.a...E.m.e.t.a.b. .I.t.a.l.y...E.m.e.t.a.b. .J.a.p.a.n...E.m.e.t.a.b. .K.e.n.y.a...E.m.e.t.a.b. .L.i.b.y.a...E.m.e.t.a.b. .M.a.l.t.a...E.m.e.t.a.b. .N.a.u.r.u...E.m.e.t.a.b. .N.e.p.a.l...E.m.e.t.a.b. .P.a.l.a.u...E.m.e.t.a.b. .Q.a.t.a.r...E.m.e.t.a.b. .S.a.m.o.a...E.m.e.t.a.b. .S.p.a.i.n...E.m.e.t.a.b. .S.u.d.a.n...E.m.e.t.a.b. .S.y.r.i.a...E.m.e.t.a.b. .T.o.n.g.a...E.m.e.t.a.b. .Y.e.m.e.n...E.m.e.t.a.b. .n.i.g.e.r...E.m.e.t.a.b. .A.n.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\kn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8676
                                                                                                                            Entropy (8bit):4.564190554248838
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:E4S8C9i2e0wkc/YqiEtipDZsp1S9l1SnQXHEqpJ89VC:hTmLHwIXs+YNq82
                                                                                                                            MD5:9577A1BF43D750F1FB7D50F437D20FC8
                                                                                                                            SHA1:D24BE5CF5719FE6D7E9F104464206D9A561DA25D
                                                                                                                            SHA-256:9942CE5B879FC51766E09DA90A3EEDB2DE3335AE3EBCE0BBCC446C4F518CCC2A
                                                                                                                            SHA-512:62E47D77C181ED1A4310E17C2C7DEE45C0182EFFD01D6003ED8675493A9425814704F1F87B7911643BE36F067A294CE9229AC19005298469E2510184418CD0EF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................j.. ..!.....q...q...$......!j...5K.y....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\lag.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5728
                                                                                                                            Entropy (8bit):4.301535633570821
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:btTCHQ3cVUtNfxLH5SL71HO52+P1QmrNtVqlS0kXF9D5+qZy9:l6QsKVZSLpHO52+dQ8NtVq8fFRcoy9
                                                                                                                            MD5:205E77719702CE43DD69B27461BFC4EE
                                                                                                                            SHA1:CD89A275C08944D8B0CB681B9BBCEC3D217F3F76
                                                                                                                            SHA-256:2CBB41EE763649A5D79FBA145F01C3001AAAB8ED369AFB50160026728CDDBB34
                                                                                                                            SHA-512:121303D0EE758ACD3C522A5F592EBC72AC2432F0CE8F92D656CE784FFE24D0943C9B72F63A51E2A992DC717938EF3762746976694671902D88FFC952E8178B9C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................5K.y..F...i.j.i...G.w.a.n.i...G...a.n.a...G...i.n.e...J...j.i.a...M...a.l.i...N.i...u.e...N...i.j.a...P...e.r.u...T...o.g.o.....m.a.n.i...A.n.d...r.a...A.r...u.b.a...C.h...a.d.i...C.h...i.l.e...C.h...i.n.a...H.a...i.t.i...I.r...a.k.i...J...d.a.n.i...K.y...u.b.a...K...n.a.d.a...K...e.n.y.a...L.a...o.s.i...M.i...a.m.a...M...l.i.t.a...M...s.i.r.i...N.a...u.r.u...P.a.l...a.u...P.a.p...u.a...S.a.m...o.a...S...m.b.i.a...T...o.n.g.a...U.f...i.n.i...U.r...u.s.i...Y...m.e.n.i.....k.w.a.d.o...D.r...e.n.o...A.m.e.r.h.k.a...A.n.g...o.l.a...B.a.h...a.m.a...B.e.l...i.s.e...B.e.n...i.n.i...B.u.k...i.n.i...B.u.t...a.n.i...B...s.i.n.i.a...E.s.t.o.n...a...G.a.b...o.n.i...G.u.y...a.n.a...J.a.m...i.k.a...J.a.p...a.n.i...J.i.b...u.t.i...K.a.t...a.r.i...K.o.m...o.r.o...K...w...i.t.i...L.e.s...o.t.o...M.a.l...a.w.i...M.a.y...o.t.e...M.o.d...i.v.u...M.o.n...a.k.o...M.o.r...i.s.i...M.o.r...o.k.o...N.e.p...a.l.i...P.a.n...a.m.a...P...l.a.n.d.i...R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\mgh.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3140
                                                                                                                            Entropy (8bit):4.108582351284262
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:V9rYqMTeXHSki6ngjSl6hV34a0q9wT350ZNE:VCKyki6nsSl6hVFyTyE
                                                                                                                            MD5:336EBE33CFC1401C9C398C07F1BB834F
                                                                                                                            SHA1:CCF59EA8A96E913129151FD5917B95AE342F4765
                                                                                                                            SHA-256:3BABD6C8C6ADDB43C2606804BCACB523FEE25153B52FB763AD85CBA0F116F2CF
                                                                                                                            SHA-512:CBBEC77D89D993FE50927360AA524275C8B8EA5F8F4130F4A5B68250827065BEAE0FD185D34001E0ECA157C9E3B49FF815EF360B8EC3988462145B96D4FD99B7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..}....................}....5K.y..U.f.i.j.i...U.g.a.n.a...U.g.i.n.e...U.g.w.a.m...U.k.u.b.a...U.t.o.g.o...U.t.u.k.i...U.b.e.l.i.n...U.c.h.a.d.i...U.c.h.e.k.i...U.c.h.i.l.e...U.c.h.i.n.a...U.h.a.i.t.i...U.j.o.j.i.a...U.k.e.n.y.a...U.k.o.n.g.o...U.l.i.b.y.a...U.n.o.r.w.e...U.o.m.a.n.i...U.p.a.p.u.a...U.p.e.r.u.u...U.r.u.n.d.i...U.s.a.m.o.a...U.s.a.u.d.i...U.s.i.r.i.a...U.t.o.n.g.a...W.i.r.a.k.i...U.a.n.d.o.r.a...U.b.u.k.i.n.i...U.g.a.b.o.n.i...U.g.a.m.b.i.a...U.g.u.y.a.n.a...U.j.a.p.a.n.i...U.j.i.b.u.t.i...U.k.a.n.a.d.a...U.k.a.t.a.r.i...U.k.o.d.i.v.a...U.k.o.m.o.r.o...U.l.e.s.o.t.o...U.m.a.l.a.w.i...U.m.i.s.i.r.i...U.n.i.j.e.r.i...U.p.a.n.a.m.a...U.s.u.d.a.n.i...U.t.u.v.a.l.u...U.t.w.a.n.i.a...U.y.e.m.e.n.i...U.z.a.m.b.i.a...A.l.u.j.e.r.i.a...U.a.l.b.a.n.i.a...U.g.r.e.n.a.d.a...U.h.i.n.d.i.n.i...U.i.s.r.a.e.l.i...U.j.a.m.a.i.k.a...U.k.o.r.a.s.i.a...U.k.u.p.r.o.s.i...U.l.a.t.i.v.i.a...U.l.i.b.e.r.i.a...U.n.i.j.e.r.i.a...U.p.o.l.a.n.d.i...U.r.i.t.e.r.e.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\mn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6016
                                                                                                                            Entropy (8bit):4.896917580560711
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:NozdTTJUWaJDYJpTW/rVJw/LOxaZtRTqfEmT7U77tDQU3gCaB2Bvb+qppH8nzb0X:uTTiW+YJpTW/r8/akPyEdtDDwB2Bvqqb
                                                                                                                            MD5:2E3DC1E886CC54C4B6FB4A3EA8DE82AE
                                                                                                                            SHA1:2F708EAA76814582D2AFD28C26FC3F4FE11FA609
                                                                                                                            SHA-256:F3208BAE5D84BD14436FE3662E2881C182AA18D50BD48F344A5B8F8B34C19F5E
                                                                                                                            SHA-512:0648C07E13E42D044BCBFC2DAD40D20AAA6DBFF2459F0552A7A5479B8216CBF0ECF5987F553F6CF54ECEB6B23BAE4826FFB85EC12AA1B658D21C3B8630B9C9F3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................$...........5K.y............#...........'.5.E.....@.5.:.......@.6.....0.=.8.....5.=.8.....8.2.8.....@.>.A...!.8.@.8...".C.@.:...$.8.6.8...(.2.5.4.../.?.>.=.....=.3.>.;.....0.;.1.0.....0.<.1.8.....0.<.1.8.....0.=.0.4.....0.B.2.8.....0.=.0.<.....>.;.L.H... .C.<.K.=...!.5.@.1.8...#.=.3.0.@...$.@.0.=.F...%.O.B.0.4...-.B.8.>.?.....2.A.B.@.8.....;.1.0.=.8.....@.<.5.=.8.....5.;.L.3.8.....>.;.3.0.@.....>.;.8.2.8.....5.@.<.0.=.....M.;.E.8.9.....@.;.0.=.4.....A.?.0.=.8.....>.@.4.0.=.....0.<.1.>.6.....8.1.5.@.8.....0.;.0.9.7.....5.:.A.8.:.....>.;.4.0.2.....>.=.3.>.;.....0.<.8.1.8.....8.3.5.@.8...!.;.>.2.0.:...#.:.@.0.8.=...%.>.@.2.0.B...-.A.B.>.=.8.....>.B.A.2.0.=.....=.4.>.=.5.7.....>.;.C.<.1.8.....0.:.5.4.>.=.....0.;.L.4.8.2.....>.@.>.:.:.>.....L.O.=.<.0.@.....>.@.2.5.3.8...!.;.>.2.5.=.8...".0.=.7.0.=.8..."...2. ...7.8...$.8.=.;.O.=.4...-.=.M.B.E.M.3...-.@.8.B.@.5.9.....2.A.B.@.0.;.8.....@.3.5.=.B.8.=.....5.=.5.A.C.M.;.....2.0.4.5.;.C.?.....2.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\mo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8796761086931277
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMf6E7lOtdsO:SvS6ga
                                                                                                                            MD5:0BB3E739719A5C203FED526ABDE45867
                                                                                                                            SHA1:751D5F5CB5F1680E76B75290014B4750DCE35977
                                                                                                                            SHA-256:01386960C1900C1CFBE656D29E88EA35F4BA1D78D7988644D86EC45F34801119
                                                                                                                            SHA-512:2CDDCC772B8B6A40FE928F747197D1B29F08F77831EF1528ADB353041B58D272C685ED2115D71D2E9C1977D497E8B63027EBF98A9A881A422AFC74C410156879
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..'....................'....5K.y.......'

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\mt.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):7012
                                                                                                                            Entropy (8bit):4.454589802438993
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:/RdNPtg6lEdl+iuRDwHA2qs8sWtDqpvBzdg:/PNPtg6li+Z0gm7WpcBhg
                                                                                                                            MD5:63AF89DDBB1D47406505FF260F8F1236
                                                                                                                            SHA1:6778D65EDFD8C375CA961D48A30E4912A1EE7811
                                                                                                                            SHA-256:0C333EA48C3334602D88ACC9A2629853EEDD8D167F828834EEC2AA7B3928BE93
                                                                                                                            SHA-512:361DCA49295B9B06A59722EAC8F2E0B4E5EB8C1A246B8ED647063A6A128594C56357CCCEC8FB4BBF082A1EA6359DAC9ED20E720FE3754FDA58BB0D3F5C595568
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .z....................z.....5K.y..A.s.j.a...F.i.!.i...D.i.n.j.a.....i.p.r.u...E.w.r.o.p.a...F.r.a.n.z.a...I.|.r.a.e.l...S.p.a.n.j.a...A.f.f.r.i.k.a...i.l.-.M.a.l.i...i...-...i.l.i...i...-...i.n.a...l.-.I.n.d.j.a... .i.b.i.l.t.....O...e.j.a.n.j.a...i.l.-.K.e.n.j.a...i.l.-.L.i.b.j.a...i.n.-.N.i.!.e.r...i.s.-.S.i.r.j.a...i.s.-.S.u.d.a.n...l.-.E.!.i.t.t.u...l.-.I.t.a.l.j.a...I.l.-.B.r.a.|.i.l...M.e.l.a.n.e.s.j.a...P.o.l.i.n.e.s.j.a...i.l.-.B.e.l.!.j.u...i.l.-.G.a.m.b.j.a...i.l.-.G.r.e...j.a...i.l.-.G.u.i.n.e.a...i.l.-.G.u.y.a.n.a...i.l.-.K.u.w.a.j.t...i.l.-.L.a.t.v.j.a...i.l.-.L.i.b.a.n.u...i.l.-.M.a.l.a.w.i...i.l.-.M.a.r.o.k.k...i.l.-. .a.p.p.u.n...i.l.-. .o.r.d.a.n...i.r.-.R.u.s.s.j.a...i.s.-.S.e.r.b.j.a...i.t.-.T.a.j.w.a.n...i.|.-.{.a.m.b.j.a...l.-.A.r.m.e.n.j.a...l.-.E.s.t.o.n.j.a...l.-.E.t.j.o.p.j.a...l.-.I.|.v.e.z.j.a...l.-.U.k.r.a.j.n.a...l.-.U.r.u.g.w.a.j...l.-.i.|.l.a.n.d.a...i.l.-.B.o.l.i.v.j.a...i.l.-.K.r.o.a.z.j.a...i.l.-.L.i.b.e.r.j.a...i.l.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\naq.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3296
                                                                                                                            Entropy (8bit):4.746544504742137
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:C3Tk4asHzql2wjzP5PKTaXaaFp0kXF9D5+4+ehg:3h3pN1fFRcEhg
                                                                                                                            MD5:5ED1EFBC861226F9ACD4BB217E747B53
                                                                                                                            SHA1:7B7E7EF3D60422B1E19E849369A5265EC11C0303
                                                                                                                            SHA-256:A2E4A3BCBD8CF21F361EDD2BC6A109C96BB82ABCDB9304BC3DCE25712E3499A7
                                                                                                                            SHA-512:021EAE11C95DBA7958CC2885B6F40B112B42D9692B725C2C7039A55B0F6FA5CBBE68017C21F509C0AC4E1008C9B6AAD9A841E362072A02723C4D7697115CFB78
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................,.. .4......0...0.........4.,...5K.y..C.u.b.a.b...F.i.j.i.b...I.r.a.q.i...M.a.l.i.b...P.e.r.u.b...T.o.g.o.b...A.r.u.b.a.b...B.e.n.i.n.s...C.h.i.l.i.b...C.h.i.n.a.b...C.o.n.g.o.b...G.h.a.n.a.b...I.n.d.i.a.b...I.r.a.n.n.i...K.e.n.y.a.b...L.i.b.y.a.b...N.i.g.e.r.i...R.a.s.i.a.b...S.w.e.d.e.b...S.y.r.i.a.b...A.n.g.o.l.a.b...B.h.u.t.a.n.s...E.g.i.p.t.e.b...G.a.m.b.i.a.b...I.r.l.a.n.d.i...I.t.a.l.i.a.b...J.a.p.a.n.n.i...K.a.n.a.d.a.b...M.a.l.a.w.i.b...M.e.x.i.c.o.b...R.w.a.n.d.a.b...S.p.a.n.i.e.b...S.u.d.a.n.n.i...U.g.a.n.d.a.b...Z.a.m.b.i.a.b...A.l.b.a.n.i.a.b...A.l.g.e.r.i.a.b...A.m.e.r.i.k.a.b...A.n.d.o.r.r.a.b...A.r.m.e.n.i.a.b...A.u.s.t.r.i.a.b...B.o.l.i.v.i.a.b...B.u.r.u.n.d.i.b...C.r.o.a.t.i.a.b...D.e.n.m.a.r.k.i...E.c.u.a.d.o.r.i...E.r.i.t.r.e.a.b...E.s.t.o.n.i.a.b...F.i.n.l.a.n.d.i...G.e.o.r.g.i.a.b...J.a.m.a.i.c.a.b...J.o.r.d.a.n.n.i...L.e.s.o.t.h.o.b...L.i.b.e.r.i.a.b...N.a.m.i.b.i.a.b...N.i.g.e.r.i.e.b...N.o.o.r.w.e.e.b...S.o.m.a.l.i.a.b...T.u.n.i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\nb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2796
                                                                                                                            Entropy (8bit):5.5411897860867265
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:wPxlPMbmDB4agk24Da70rG/9XrX//92tEA/9zVjWQorNnqpZXXZJ8HHzHH7GFmO2:wplEboBHYwI9T92Ku9qqppH8nzbGVSfL
                                                                                                                            MD5:D2C34DACC62207504883361675C82010
                                                                                                                            SHA1:0115BDB5D245920954A26E811B0EBFBBC6ECB8AD
                                                                                                                            SHA-256:4141C6EDD1A0F36328D15A341F268F86CE58D40F6F71B554D24BB2CBEB9CC6D5
                                                                                                                            SHA-512:F97FBBF3B64930785AEDC0729D611B7BC798E78441B20D8BDAE1F1952D44FFB9DE015A7960162E9E9DBC7DA484E5370F02DD4DCB5BD2D00F087ACFF54C552646
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................$...........5K.y..F.N...E.U...H.e.l.l.a.s...S.v.e.i.t.s...T.y.r.k.i.a...v.e.r.d.e.n...F...r...y.e.n.e...K.o.m.o.r.e.n.e...S...r.-.A.s.i.a...T.s.j.e.k.k.i.a.....s.t.-.A.s.i.a...C.o.o.k...y.e.n.e...M.a.l.d.i.v.e.n.e...e.u.r.o.s.o.n.e.n.....s.t.-.T.i.m.o.r.....s.t.e.r.r.i.k.e...K.o.k.o.s...y.e.n.e.....s.t.-.A.f.r.i.k.a...C.a.y.m.a.n...y.e.n.e...F.i.l.i.p.p.i.n.e.n.e...K.a.n.a.r.i...y.e.n.e...S.e.y.c.h.e.l.l.e.n.e...S.a.l.o.m.o.n...y.e.n.e...H.v.i.t.e.r.u.s.s.l.a.n.d...M.a.r.s.h.a.l.l...y.e.n.e...P.i.t.c.a.i.r.n...y.e.n.e...F.a.l.k.l.a.n.d.s...y.e.n.e...M.e.l.l.o.m.-.A.m.e.r.i.k.a...N.o.r.d.-.M.a.k.e.d.o.n.i.a...N.o.r.d.-.M.a.r.i.a.n.e.n.e...S...r.l.i.g.e. .A.f.r.i.k.a...U.S.A.s. .y.t.r.e. ...y.e.r...N.o.r.d.l.i.g.e. .A.m.e.r.i.k.a...A.f.r.i.k.a. .s...r. .f.o.r. .S.a.h.a.r.a...T.u.r.k.s.-. .o.g. .C.a.i.c.o.s...y.e.n.e...D.e. .b.r.i.t.i.s.k.e. .j.o.m.f.r.u...y.e.n.e...D.e.t. .p.a.l.e.s.t.i.n.s.k.e. .o.m.r...d.e.t...H.e.a.r.d.-. .o.g. .M.c.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\no.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):84
                                                                                                                            Entropy (8bit):2.692276143673127
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlZelgylslplglYug8RHl9P:SBtkJQltWpglYuHH7P
                                                                                                                            MD5:A20A266B4FDEA042A20F265468A6A501
                                                                                                                            SHA1:36F9102A3169B1787817FCEA34E8C0A198761657
                                                                                                                            SHA-256:D2805C8B1BB6406742A9ECD71F92C9B8302DD930114AA5EEFEF13A66AFC156D2
                                                                                                                            SHA-512:4D582ADED5FA133C7F83499DC459A518A01BF6B43F1581BCA109D39429C366D2C342F0FCB89A093F3FC0087831BC0DB267367DE99159F5C5968DF422D9A7D707
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y..n.b...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\nyn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1748
                                                                                                                            Entropy (8bit):5.754796875499855
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:8qAG2+dovzWINpmkXWa9D5HekaM9c2sXfeL:97ZdS70kXF9D5+7MGPM
                                                                                                                            MD5:90C26955F2554BF6A6287240F9190520
                                                                                                                            SHA1:B3277800095C78449D2CB937467C5EB446ABABE9
                                                                                                                            SHA-256:4C13F180B8EC2A4A89122AC6AE9F45BF87ABD495235461C7A55093968E617769
                                                                                                                            SHA-512:AC84BB969287ACDE176C5FADC2CCE2DCB520E39748801E984F5651A6328C140476ECA025FA630F36573102E964D10BC219CCE85F6E129583143D36F1FE762001
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................5K.y..G.u.n.i...M.a.r.i...N.e.p.o...I.t.a.r.e...S.w.i.s.i...A.n.g.o.r.a...B.e.r.i.z.e...B.u.f.i.n.i...I.k.w.e.d.a...I.r.a.a.k.a...I.r.a.a.n.i...K.o.r.o.m.o...M.a.r.a.w.i...M.a.r.i.t.a...N.a.i.g.y.a...N.o.o.r.w.e...P.o.c.u.g.o...R.r.a.s.h.a...T.u.v.a.r.u...A.n.g.w.i.r.a...G.a.b.o.o.n.i...G.u.r.i.i.s.i...G.y.o.g.i.y.a...K.u.w.e.i.t.i...P.a.l.a.a.w.u...A.r.u.b.a.n.i.a...B.a.r.a.r.u.s.i...G.y.a.m.a.i.k.a...G.y.a.p.a.a.n.i...H.o.o.r.a.n.d.i...I.r.e.r.a.n.d.i...I.s.i.r.a.i.r.i...K.o.r.a.s.i.y.a...M.o.n.g.o.r.i.a...M.o.r.i.d.o.v.a...M.y.a.n.a.m.a.r...O.s.i.t.u.r.i.a...P.i.t.k.a.i.n.i...P.o.o.r.a.n.d.i...T.a.i.r.a.n.d.i...T.o.k.e.r.a.w.u...U.k.u.r.e.i.n.i...P.a.r.e.s.t.i.i.n.a. .n.a. .G.a.z.a...E.b.i.z.i.n.g.a. .b.y.a. .I.n.d.i.a.n. .e.b.y.a. .B.u.n.g.y.e.r.e.z.a...............................................................................................".+...1.7.:.=.@.C.I.L.O.U.X.[.d.g.j.m.s.v.y.|...............................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\or.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8548
                                                                                                                            Entropy (8bit):4.518913879329421
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:aRnys3rxKvznNGLHmjPfflDRq8An+2myUbDwKSNXy8OizTqpJ8T6R:4N2GSr3ZUebDnUPq8GR
                                                                                                                            MD5:DFA60ED2B3D70EC1FD47B6D07E471DEB
                                                                                                                            SHA1:4994BBFEFE45552D0FB678DDAE2E3B126504A424
                                                                                                                            SHA-256:B607295DC200962B6EE638DC8742FF3C166D147ED37296C3D16D4061D6620085
                                                                                                                            SHA-512:9E76BCDB3FEDAA83446124E70040DB69199F566580D6CD00FF28CD1C1A7ECD457B8A8209DE476AC17D78227589F838F8FC614BD8849BC7BA47086A447891E3CA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................J.. ..!.....Q...Q...&......!J...5K.y..(.?.......0.>.(.....>.(.>.....>.&.M.....?.(.M.....K...K...(.0.q.G...*.G.0.A...+.?...?...-.>.0.$.....>.2.?..._.A...G.....0.A.,.>.......>.2.@.....0.>...M.......>.(.M.....$.>.0.M.....A...$.M.....A.....M.....G...?.......0.M.8.?.....>.*.>.(...(.>.....0...(.>...0.A...(.G.*.>.3...*.>.2.>.....,.?.6.M.q...-.A...>.(.....0.?.8.8.....>...>.......>.2.q.?...0.A.7.?.....2.>...8.M...8.?.0.?.....9... .......9.>...$.?.......?.*.M.......0.A...A.......>.(.>.!.>.....G.(.?._.>.....K.8.K.-.K.....M.q.?.,.>.....>.,.K.(.M.....M.0.@.8.M.....?.2.M.2.@.....0.M...?.......?.,.K...?.....K...M...>...$.>...q.>.(...$.A.-.>.2.A...$.A.0.M...@...*.>.(.>...>...,.G.(.?.(.M...,.G.2.?...M...,.K.2.-.?.......>.2.M...>.....>._.K...G.....K.(.>...K...2.>...-.?.....2.?.,.M._.>...2.G.8.K.%.K...8.0.M.,.?.....8.M.*.G.(.M..._.G...G.(.M.......M...K.2.>.....#.M.!.K.0.>.....2...G.0.?.......2.,.>.(.?.......%.?...*.?.........>.#.M.!.>.....A.0.>...>.......K...K.0.8.M.....>.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\os.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):400
                                                                                                                            Entropy (8bit):4.482269378093527
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvulJu0hHroiatjy/Wh4r566IAism/cLD/2h+uyaQfKQVifWlKlh6hLLkvl+n:Y0Foam6ssWoDNfZYOQlMlLuo
                                                                                                                            MD5:0C39DD0B94EAC67B28912AE4F258D1BE
                                                                                                                            SHA1:0B4AAFE3065506623FC07415EADDDC601C0C0536
                                                                                                                            SHA-256:25EEC410A057F71FB7AE277487F69D004E38D90BB2DF523CF32458BF74C2EDC0
                                                                                                                            SHA-512:FCE8C5F0E76B0C20F6D12B196F6F72B2CC32CBF9970DF15D6700C7A6AD49063D372C4C7F86240CA61F35C3B0EE4BE15A149D996870C942E23D5E178E13B0CDEF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................X.. ........\...\...........X...5K.y......(.....7.8.....C.=.5.....=.4.8.../.?.>.=...$.@.0.=.F.....D.@.8.:.......5.@.<.0.=.....2.@.>.?.......:.5.0.=.8...#...@...A.5.....<.5.@.8.:.......@.0.7.8.;.8.....C.K.@.4.7.K.A.B.>.=...!.B.K.@. ...@.8.B.0.=.8.......7.>.=.3... .1...A.B.............6.b.n.....1.s.y...........Y...$.9.N.\. .G.d...@.3.x.l.).....U...............x..P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pa.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):7536
                                                                                                                            Entropy (8bit):4.616013059031144
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:G1NhrTHBIo93MPxOHEvdLenTThdjLAMarNqpJ85tzIrFX:GfhJIcsIcq8UrFX
                                                                                                                            MD5:F553898247292782F5C9772A0B96A648
                                                                                                                            SHA1:89B4BF3C035D28D78F81DE0F475D6B5A90367F31
                                                                                                                            SHA-256:D326D208E514D6C250096C7A76655AF3348D7ED7E083844E3C3CBCA895C52C8B
                                                                                                                            SHA-512:3D38A2C05A6CCC3D7F3BCD45EA6EC0D317118C3CCE2794C41D65060ED168B0982960B160F3493F3E803D20A5DD2F312303DE5A2C82621A596D7A337FA7128B7E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................M.. .(%.....T...T...$.....(%M...5K.y....$.0.....>.!.../...(.......2.@.....0.>.......0.>.(.......>.(.....,.K.(.....A.........>.(.>.....?.2.@.....*.>.(.....0.8.@.....K...K...(.?./.B...*.2.>.....*.G.0.B...-.>.0.$.......>.......>.2.@.....?.8.0...2.>...8...8.*.G.(...9.H.$.@.....0.B.,.>.....?...,.>.....@.(.@.......A.5.H.$.....0.(...@.....M.0.@.8.....H...@.......0...(.@.....>.0.!.(.....L.....>...$.A.0...@...(.>.....0...(.>...0.B...(.>.0.5.G...(.G.*.>.2...*.(.>...>...+.<.?...@...,.G.(.?.(...-.B...>.(.....2.>.5.@.....>.2...>...2.@.,.@.....8.0.,.@.....8.5.@.!.(...8.>...K.....8.@.0.@.....8.B.!.>.(...8.p.8.>.0...9.p...0.@.....p...K.2.>.....p.!.K.0.>.....8...0.@.......%.K.*.@.......0.B...5.G.....H.(.G.!.>.....H...0.B.(.....K.8.K.5.K.....A./.>.(.>.....H...,.@.........>.....>.....>.0...@.......A.5.>.2.B...$.>...5.>.(...*.K.2.H...!...+.<.0.>...8...,.0...B.!.>...,.0.B.(.G.....,.9.>...>.8...,.9.?.0.@.(...,.G.2.@...<.....>./.K...@.....>.2.&.@.5.....K.(.>...K.....K.0.q...K.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pa_Arab.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):96
                                                                                                                            Entropy (8bit):3.229056480515185
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tluFr2t9vlullal1BsP9mZDlMlAtn:Sv6qtmlEDc9mZDlBtn
                                                                                                                            MD5:B96D1C36722A0227462AD011F3C8E493
                                                                                                                            SHA1:42B4468CD47F62233636872349C2F3329131D506
                                                                                                                            SHA-256:3868207145A4594D1CAFC4DA91E606EBD2094D8DBAC643E76050469622725F50
                                                                                                                            SHA-512:322747A90E8C676D8EBD73A1145B3CDFC40C3617BB8E492A1A623677633AD67C589B25D9FAB19D60CCC613A226386B7D3F3CE5F186FA5DB749A9D8BADD2D7613
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .. .................... ....5K.y...................`...P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pa_Guru_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/dsp:SBtkJ1li6gml/8
                                                                                                                            MD5:3F209B3AA35603DCBB208A74CAA36C86
                                                                                                                            SHA1:249DE057005BE697205333ABA0433C5B04653BBB
                                                                                                                            SHA-256:F3965E339C622C96879DEE316DE42F9E9F693DDEB7A52FDCEBBA027171F2C86A
                                                                                                                            SHA-512:02411AE5728814057E0CA78D850EEA85B3ACA16DFDBEE97A7C01860DA3B82640EEBE60960938C7F64B05D9E9FE8BAE0B826D242E24B33C40024836F716F17E31
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pa_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.945547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/dP7Mx/1P:SBtkJYlU8g8l/1IZ1P
                                                                                                                            MD5:6760A138D30FB15DA4638F9222503DFE
                                                                                                                            SHA1:F11F287CF4071D6484E5BA2F5CF82EB91ACDE066
                                                                                                                            SHA-256:7F2CBEC17D56520885A79550149BB793A867239CE35657A25AA0EB024B2D6A21
                                                                                                                            SHA-512:169BF401F9977966604D77618717C1BCE84F4B6128F268AB3D73875D44A3D32DB8D358CA9D87F971205836EF2FE87406FBB860A12D483CB188BD2EC73F854B33
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y..p.a._.G.u.r.u._.I.N...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pa_PK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.905547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/dPRJDP:SBtkJYlU8g8l/1RZP
                                                                                                                            MD5:EB9D9231B8A00082A5998FB7EEA309B9
                                                                                                                            SHA1:3697B4F58D17DB9CF4DD2DF17CA2E820F362C42B
                                                                                                                            SHA-256:92B84E3D79FD624F95A116E6C68BE1C014B09C1A0CDBEC30B27A4FD8B58A151F
                                                                                                                            SHA-512:51C0255C24875D448BA3876C8078BE733F8C3632CEC09A1B2E263036E7D315FEC87AA24437E136478A727C71929432FCE83BB8C50ED05DE73A303BED87D49B00
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y..p.a._.A.r.a.b._.P.K...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pt.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4032
                                                                                                                            Entropy (8bit):5.032533647396089
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:pxtzkdcGaRGeuYnrOq/cdqppH8nzOhzT9stXx:VzkxaRGeuYnrOq/WqpJ8GqXx
                                                                                                                            MD5:5B7F485FCFE4220EF1D431BFD09183FA
                                                                                                                            SHA1:AE6A6B81DE7B5D4EF8306EB4A6EDEA013EE76044
                                                                                                                            SHA-256:FC6CD34DEDF08360BF728D06295D05B80CE0F04D31A9F455F79B3A38BE7E3992
                                                                                                                            SHA-512:85E41B2906798812E9B1E90B8CEF1D46D304181A5DFF15D77A63CDF0DEADE6C885A7359CF1DFE5E009F4A8FF31FAAA5AAEDCBB77FB4651D167C75A31F931F8B1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...............&..........5K.y..I.r.....O.m.......s.i.a...B.u.t...o...C.h.a.d.e...E.g.i.t.o...G.a.b...o...I...m.e.n...J.a.p...o...S.u.d...o...S.u.....a...G.r...c.i.a...G...m.b.i.a...I.r.a.q.u.e...M...n.a.c.o...Q.u...n.i.a...S.u...c.i.a...S...r.v.i.a...V.i.e.t.n.....Z...m.b.i.a...A.l.b...n.i.a...A.r.g...l.i.a...A.r.m...n.i.a...C.a.m.b.o.j.a...C.r.o...c.i.a...E.s.p.a.n.h.a...E.s.t...n.i.a...G.e...r.g.i.a...H.u.n.g.r.i.a...L.e.t...n.i.a...M.a.l...s.i.a...P.o.l...n.i.a...R.e.u.n.i...o...R.o.m...n.i.a...U.c.r...n.i.a...A.l.e.m.a.n.h.a...A.m...r.i.c.a.s...C.a.m.a.r...e.s...C.o.l...m.b.i.a...E.r.i.t.r.e.i.a...I.s.l...n.d.i.a...J.o.r.d...n.i.a...L.i.t.u...n.i.a...M.a.u.r...c.i.o...T.a.n.z...n.i.a...T.c.h...q.u.i.a...Z.i.m.b...b.u.e...M.e.l.a.n...s.i.a...P.o.l.i.n...s.i.a...S.e.i.c.h.e.l.e.s...P.s.e.u.d.o.b.i.d.i...A.u.s.t.r.a.l...s.i.a...C.a.z.a.q.u.i.s.t...o...G.r.o.e.n.l...n.d.i.a...I.l.h.a. .B.o.u.v.e.t...I.l.h.a. .d.e. .M.a.n...I.l.h.a.s. .A.l.a.n.d...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pt_CH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.137653166597381
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMKlllFq8lvmY2:SvzlvmB
                                                                                                                            MD5:606DD5E86352CBA8A2A4F4561837824B
                                                                                                                            SHA1:5C0059F5CBDD887FB652FA79AD87AAC0F8865EA8
                                                                                                                            SHA-256:3A85BADE8A7A6DB69C28C9388EF247294248DF06F9D9D406198479426B31D70C
                                                                                                                            SHA-512:66C908320950530C345997B522E12D7D6603DF931FE32B43644A2DDFA12BE7795C9582C070ADB744FBDE9DF287816FC8584F5F1A2BC2158ABD8BFC9BA4B20E0C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.:"...................:"....5K.y..........9"

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pt_LU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.137653166597381
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMKlllFq8lvmY2:SvzlvmB
                                                                                                                            MD5:606DD5E86352CBA8A2A4F4561837824B
                                                                                                                            SHA1:5C0059F5CBDD887FB652FA79AD87AAC0F8865EA8
                                                                                                                            SHA-256:3A85BADE8A7A6DB69C28C9388EF247294248DF06F9D9D406198479426B31D70C
                                                                                                                            SHA-512:66C908320950530C345997B522E12D7D6603DF931FE32B43644A2DDFA12BE7795C9582C070ADB744FBDE9DF287816FC8584F5F1A2BC2158ABD8BFC9BA4B20E0C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.:"...................:"....5K.y..........9"

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\pt_MO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.137653166597381
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMKlllFq8lvmY2:SvzlvmB
                                                                                                                            MD5:606DD5E86352CBA8A2A4F4561837824B
                                                                                                                            SHA1:5C0059F5CBDD887FB652FA79AD87AAC0F8865EA8
                                                                                                                            SHA-256:3A85BADE8A7A6DB69C28C9388EF247294248DF06F9D9D406198479426B31D70C
                                                                                                                            SHA-512:66C908320950530C345997B522E12D7D6603DF931FE32B43644A2DDFA12BE7795C9582C070ADB744FBDE9DF287816FC8584F5F1A2BC2158ABD8BFC9BA4B20E0C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.:"...................:"....5K.y..........9"

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\qu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1300
                                                                                                                            Entropy (8bit):6.067993847402924
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:5l9WMwj+lX5sD0Ilan6Mr7nNpmOJx+vJnchZSWZyuLixavv76n0KGtoNUCCL+h8n:RHwWsDJUBr7nVJYvihMWZ+Qv74Gto6CG
                                                                                                                            MD5:1A951C187745FBC669A2AAF5FE259D85
                                                                                                                            SHA1:471AC0F9E7EAF3A991B9A0EC779B922410252BAC
                                                                                                                            SHA-256:4E770FE256A9227FAD9FEE6A655D2CAEB3060D8977A95F2C9C51E17EC46791D8
                                                                                                                            SHA-512:6A2B27A953CC446A961F231159FF2C4C9E40CC8CB0B0B58CEF44F34E063B36AD87F0202C7F1188FA271DB8C2D9609805B3191814A0D80D0C27D4C5B0AD09B7CE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................9.. ........=...=...........9...5K.y..F.i.y.i...T...n.e.z...B.a.r...i.n...Y.i.b.u.t.i...A.r.g.e.l.i.a...B.o.n.a.i.r.e...C.u.r.a.z.a.o...P.a.k.i.s.t...n...M.a.c.a.o. .R.A.E...E.R.Y. .M.a.c.e.d.o.n.i.a...I.s.l.a. .C.h.r.i.s.t.m.a.s...H.o.n.g. .K.o.n.g. .(.R.A.E.)...P.a.l.e.s.t.i.n.a. .K.a.m.a.c.h.i.k.u.q...E.E...U.U... .I.s.l.a.s. .V...r.g.e.n.e.s...S.a.n.t.a. .S.e.d.e. .(.C.i.u.d.a.d. .d.e.l. .V.a.t.i.c.a.n.o.)...I.s.l.a.s. .m.e.n.o.r.e.s. .a.l.e.j.a.d.a.s. .d.e. .l.o.s. .E.E...U.U.............................................................................%.(.+.1.7.:.=.C.I.L.O.U.X.[.d.g.m.s.v.y...............................................................................!.$.'.*.0.3.6.<.?.B.E.H.K.Q.T.Z.`.c.f.i.l.r.u.x.{.~....................................................................................... .#.&.).,.2.8.;.>.A.J.P.S.Y.\._.b.h.n.q.t.w.z.........K!.5.!.!...@.`.".?19#R'.E3...2....i!$...g3E...'..EvA..}.h`../....3.R..,.U.......U$.3...!.!..U!..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\res_index.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3756
                                                                                                                            Entropy (8bit):4.96994431325348
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:6RjBgHiZE09u1gAmcN0wBLmXybNTTjW8joLnmBxuJf0cC+zFh7s74trcs:Iwi1+gAyYdTSkE4xuWcC+zFts74D
                                                                                                                            MD5:F487A3A428E3C8C4B88A457AFB9F8E90
                                                                                                                            SHA1:F3C926B63B0D4F86AE91DCC3BF78FCFF3E0213B7
                                                                                                                            SHA-256:65628294C10054DE4B62CD66558DA6C2E06D1E7FEA9556B46D1F60B15BED52E5
                                                                                                                            SHA-512:5FA90668B02AA313F5B1E822671F9711D972D7DEA7DD47B7CD943375C47664B61D2C824B8D810142DCB291854494287B08F14997BFF0208C5532AB6D1C6E8E2B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................InstalledLocales.af.agq.ak.ar.ar_AE.ar_LY.ar_SA.asa.ast.az.az_Cyrl.az_Latn.az_Latn_AZ.bas.be.bem.bez.bg.bm.bn.bn_IN.bo.bo_IN.br.brx.bs.bs_Cyrl.bs_Latn.bs_Latn_BA.ca.ccp.ce.ceb.cgg.chr.ckb.cs.cy.da.dav.de_AT.de_CH.dje.dsb.dua.dyo.dz.ebu.ee.el.en.en_150.en_AG.en_AI.en_AT.en_AU.en_BB.en_BE.en_BM.en_BS.en_BW.en_BZ.en_CA.en_CC.en_CH.en_CK.en_CM.en_CX.en_CY.en_DE.en_DG.en_DK.en_DM.en_ER.en_FI.en_FJ.en_FK.en_FM.en_GB.en_GD.en_GG.en_GH.en_GI.en_GM.en_GY.en_HK.en_IE.en_IL.en_IM.en_IN.en_IO.en_JE.en_JM.en_KE.en_KI.en_KN.en_KY.en_LC.en_LR.en_LS.en_MG.en_MO.en_MS.en_MT.en_MU.en_MW.en_MY.en_NA.en_NF.en_NG.en_NL.en_NR.en_NU.en_NZ.en_PG.en_PH.en_PK.en_PN.en_PW.en_RW.en_SB.en_SC.en_SD.en_SE.en_SG.en_SH.en_SI.en_SL.en_SS.en_SX.en_SZ.en_TC.en_TK.en_TO.en_TT.en_TV.en_TZ.en_UG.en_VC.en_VG.en_VU.en_WS.en_ZA.en_ZM.en_ZW.es_419.es_AR.es_BO.es_BR.es_BZ.es_CL.es_CO.es_CR.es_CU.es_DO.es_EC.es_GT.es_HN.es_MX.es_NI.es_PA.es_PE.es_PR.es_PY.es_SV.es_US

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\rn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4736
                                                                                                                            Entropy (8bit):4.4125393029177555
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:gy83HRYhPvx+alSLGSxnveqQ/V1x0kXF9D5+/jPOC:0hUzEL1xnC//xfFRcrPl
                                                                                                                            MD5:AF51C4103682C64F7C0AD875320AB903
                                                                                                                            SHA1:05349C5D2D7532F4F6D86384F20E8ACCA71E4C9B
                                                                                                                            SHA-256:6B0F9FA0970F32F83C660E0F7FBBA180DF5212FC787FD8936E8D4F6EDD3D09A3
                                                                                                                            SHA-512:D6D6BCF4EE9C29BB894C669E43DD02A4F07FD9C4473D4097F31AA4472E9484C55456620DF791DE0C614F0EEB6D69316AB149B0BDBF1B228FCD48ACF5680ABBA6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .0....................0.....5K.y..G.a.b.o...K.i.b.a...G.u.n.e.y.a...G.u.y.a.n.e...I.r.i.g.w.e...L.a.t.i.v.a...L.i.b.a.n.i...M.a.r.o.k.e...S.u.w.e.d.i...B.e.l.a.u.s.i...I.k.e.r.e.n.e...K.a.m.b.o.j.e...P.a.r.a.g.w.e...P.o.l.o.n.y.e...U.b.u.d.a.g.e...B.u.r.e.z.i.l.i...B.u.r.u.n.e.y.i...E.k.w.a.t.e.r.i...G.e.r.e.n.a.d.a...I.r.i.l.a.n.d.i...M.a.l.e.z.i.y.a...M.i.g.i.z.i.k.e...M.o.l.u.d.a.v.e...M.o.l.u.d.a.v.i...N.i.j.e.r.i.y.a...N.o.r.u.v.e.j.i...O.t.i.r.i.s.h.e...R.u.m.a.n.i.y.a...S.e.h.e.l.e.n.e...S.e.l.u.s.i.y.a...T.u.n.i.z.i.y.a...T.u.r.u.k.i.y.a...U.b.u.g.a.n.d.e...U.b.u.h.i.n.d.i...U.b.u.r.u.n.d.i...V.a.n.u.w.a.t.u...u. .R.w.a.n.d.a...A.l.i.j.e.r.i.y.a...A.r.u.m.e.n.i.y.a...E.l.i.t.e.r.e.y.a...E.t.i.y.o.p.i.y.a...H.u.n.g.a.r.i.y.a...I.s.i.r.a.h.e.l.i...S.i.n.g.a.p.u.r.u...U.b.u.b.i.l.i.g.i...U.b.u.g.e.r.e.k.i...U.b.u.r.u.s.i.y.a...U.b.u.s.h.i.n.w.a...U.b.u.s.u.w.i.s.i...U.b.u.y.a.p.a.n.i...A.r.i.j.a.n.t.i.n.e...A.y.i.s.i.l.a.n.d.i...B.a.h.a.r.e.y.i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ro.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5692
                                                                                                                            Entropy (8bit):4.633986220273737
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:IhZw1J9XjpFGCqA/0ITLBZlYiBY74Q0uLI3YAUs8LCDYlYNQWdf5CVOqppH8nzOx:O0J9XjpFbHTLJY8nuNCZDCYNjN9qpJ8o
                                                                                                                            MD5:DDA065AB17AA6CE5E7236B6798AD0C12
                                                                                                                            SHA1:35AC868B54ECCDC6E20F021E56911050804A2BD0
                                                                                                                            SHA-256:190ECB2F5E12D1D5DC1DFD49C358E4CAF6CB89939759E01AF0AC871F6BA3B4C8
                                                                                                                            SHA-512:4821C9D6AF71162C665D56DB0BF5D583ADFFB3B18F908A753D81B99B0FC28CA0038B16DA47B1E6E7C64516DD6DD53C579E42567FDF603493544EECC820F2C072
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .p..............&.....p.....5K.y..C.i.a.d...L.u.m.e...C.e.h.i.a...C.i.p.r.u...M.e.x.i.c...F.r.a.n...a...S.u.e.d.i.a...T.u.r.c.i.a...A.m.e.r.i.c.i...C.a.r.a.i.b.e...C.r.o.a...i.a...E.l.v.e...i.a...G.u.i.n.e.e.a...R.o.m...n.i.a...U.n.g.a.r.i.a...B.r.a.z.i.l.i.a...C.o.l.u.m.b.i.a...E.r.i.t.r.e.e.a...F.i.n.l.a.n.d.a...I.o.r.d.a.n.i.a...M.o.z.a.m.b.i.c...S.l.o.v.a.c.i.a...D.a.n.e.m.a.r.c.a...G.u.a.d.e.l.u.p.a...T.h.a.i.l.a.n.d.a...G.r.o.e.n.l.a.n.d.a...I.n.s.u.l.a. .M.a.n...K...r.g...z.s.t.a.n...M.u.n.t.e.n.e.g.r.u...C.a.p.u.l. .V.e.r.d.e...R.e.g.a.t.u.l. .U.n.i.t...S.f...n.t.a. .E.l.e.n.a...S.f...n.t.a. .L.u.c.i.a...A.f.r.i.c.a. .d.e. .S.u.d...A.s.i.a. .C.e.n.t.r.a.l.....C.o.r.e.e.a. .d.e. .S.u.d...I.n.s.u.l.a. .B.o.u.v.e.t...I.n.s.u.l.e.l.e. .C.o.o.k...N.o.u.a. .Z.e.e.l.a.n.d.........r.i.l.e. .d.e. .J.o.s...A.m.e.r.i.c.a. .L.a.t.i.n.....A.m.e.r.i.c.a. .d.e. .S.u.d...A.r.a.b.i.a. .S.a.u.d.i.t.....A.s.i.a. .O.r.i.e.n.t.a.l.....C.o.r.e.e.a. .d.e. .N.o.r.d.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ru.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4748
                                                                                                                            Entropy (8bit):5.113677125627538
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:cVJYvtVHlZgtCddKxNk1im8mqppH8nzOfkZI4:csv7O5AqpJ8DZI4
                                                                                                                            MD5:12ECDE3D81167609E17A31EB9DBFC333
                                                                                                                            SHA1:0DAAFAE6F8752E1828DDBD9A1D911DEC33D1AFC6
                                                                                                                            SHA-256:4E9EBAC51FAE46E8BA6F24140313C954578ABAC6BF03C4AD0CFE9A53DE038C2D
                                                                                                                            SHA-512:87B7A8829A587F682419E060D2C028DB02F2D9FB92A26D83C125656D576B28F6B03AC7BA326DD363FA973A124043D79DAE7039A233B35A3A56B7791A4CB12AD3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .U..............&.....U.....5K.y......-...........!.(........... .....0.3.0.<.K.....0.@.8.1.K.....>.<.>.@.K...".C.@.F.8.O...>.-.2. ...M.=.....8.@.3.8.7.8.O.....0.;.L.4.8.2.K...-.A.2.0.B.8.=.8...2.5.A.L. .<.8.@...5.2.@.>.7.>.=.0...>.-.2. ...C.2.5...$.8.;.8.?.?.8.=.K.....8.4.5.@.;.0.=.4.K.....6.=.0.O. ...7.8.O.....6.=.K.9. .!.C.4.0.=.....0.:.0.>. .(.!... .)...>.-.2. ...>.@.D.>.;.:...?.A.5.2.4.>.-.B.i.d.i.....A.B.@.>.2.0. ...C.:.0.....6.=.0.O. ...D.@.8.:.0.....6.=.0.O. ...2.@.>.?.0...>.-.2.0. ...8.B.:.M.@.=.....>.=.:.>.=.3. .(.!... .).....0.?.0.4.=.0.O. ...7.8.O.....6.=.0.O. ...<.5.@.8.:.0...>.-.2. . .>.6.4.5.A.B.2.0...>.-.2. .!.2... ...;.5.=.K...?.A.5.2.4.>.0.:.F.5.=.B.K.....;.0.=.4.A.:.8.5. .>.-.2.0.....5.;.8.:.>.1.@.8.B.0.=.8.O.....0.=.0.@.A.:.8.5. .>.-.2.0.....>.:.>.A.>.2.K.5. .>.-.2.0.....>.2.0.O. ...5.;.0.=.4.8.O.....A.B.@.>.2.0. ...0.9.<.0.=...$.0.@.5.@.A.:.8.5. .>.-.2.0...>.-.2. ...>.7.=.5.A.5.=.8.O.....=.5.H.=.O.O. ...:.5.0.=.8.O.....5.@.<.C.4.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ru_UA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):472
                                                                                                                            Entropy (8bit):4.254770992027674
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:44/fR9vL5shJuMOD2rr50BlhZi/BmNmaBh:l/fR9vLsX5D2me
                                                                                                                            MD5:84DFD43C8EF9EB3171AE7400E9DC72B8
                                                                                                                            SHA1:D772CB903FBA0062E3CCA46B43AFFEF0DB1B360F
                                                                                                                            SHA-256:03B3E40268B8ABA753C057ADDB4A7A16DA0D7162D511FDCD7B164C871210C0D4
                                                                                                                            SHA-512:2D53C67A844A1E0D89E38A6A3D998038AABF017ECB352EF367560E4B1C63F433E23A25093A4BF4913CCAEA0C88B6B75B55F310A202704CF25A550ED187F5A6DE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................j.. ..@.....n...n..........@j...5K.y....-.2. ...C.2.5.....-.2.0. ...C.:.0.....-.2. ...>.@.D.>.;.:.....-.2. . .>.6.4.5.A.B.2.0.....-.2. ...>.7.=.5.A.5.=.8.O.....-.2. ...;.8.?.?.5.@.B.>.=.....-.2.0. .%.5.@.4. .8. ...0.:.4.>.=.0.;.L.4.....1.J.5.4.8.=.5.=.=.K.5. ...@.0.1.A.:.8.5. .-.<.8.@.0.B.K...*...0.;.K.5. .".8.E.>.>.:.5.0.=.A.:.8.5. ...B.4.0.;.5.=.=.K.5. ...A.B.@.>.2.0. .!.(.................(...~.2.S.!AVA.@.@0A.A?A.A.@tA...........P9".`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\sah.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):520
                                                                                                                            Entropy (8bit):4.704074939659196
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:D/ctTMh5ByztJoOlI/fkDMJ5MsUE1koxMvaFVlWcf:D/TPgox/l50E1kYMCvlWcf
                                                                                                                            MD5:2A14AE336F7C498FFE146F79DEF0016E
                                                                                                                            SHA1:DB3EB814E9C96CCAC20439A59EB258D44BF2FC9D
                                                                                                                            SHA-256:D864C39B4C66E38E7E2123C66FA4AC550D9AEC5B6F488ECE60207842C78D8CA0
                                                                                                                            SHA-512:A17BB659E88EE96EB4861A538D95056BB72DE1C4342259FB7ABFB181182394306A57394F82847A0085B4E81F908E45BDD40BBA05F88B60C3472797911CE810EF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................u.. ..U.....z...z..........Uu...5K.y....%.(.....C.C.1.0...'.8.8.;.8...!.C.4.0.0.=.....0.=.0.0.4.0.....8.8.1.8.9.M.....0.?.K.@.K.:.0.....8.M.:.A.8.:.M.....M.=. .0.@.K.K.....0.=. .4.>.9.4.C.....@.0.A.A.K.K.9.0.....L.0.<.0.0.9.:.0...%.>.B.C.3.C. .-.<.8.M.@.8.:.M...!.>...C.@.C.C. .-.<.8.M.@.8.:.M.....<.5.@.8.:.0. .%.>.;.1.>...C.:.B.0.0.E. .(.B.0.0.B.B.0.@.0.......................L.d.y.........$.*.-.l.........Y..U.U.U.Uv..U.U...U..}$.U...U...U.....U.U...U.U6..V..Y..U.............P...P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\saq.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):984
                                                                                                                            Entropy (8bit):6.664654262645045
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:xmrJVJ7OkJBvWa9D2h1i/veBQ+7TTKO542Kc2hdl/QZ:xMmkXWa9D5HeXTb42SqZ
                                                                                                                            MD5:2DC65410ADD51F24840BE253B3DE1E6A
                                                                                                                            SHA1:555D4E6EB7C777E657DC6FA511950B6A31426BA1
                                                                                                                            SHA-256:E8647FD90A97C6C221DEABE0E4E4F833E3B726C9424091695E2419045D7F2B60
                                                                                                                            SHA-512:01BEC81C93895A11FDB507BCFE01386D0D590E20827AAD4AB59CE50E25DE3074801996FD2B3AC9D8231AF80049DC5ECAAB8E3AD38AE8FD9B4135706CDC53F60F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..........................5K.y..............................................................................................".+...1.7.:.=.@.C.I.L.O.U.X.[.d.g.j.m.s.v.y.|...............................................................................................!.$.'.*.-.0.3.6.?.B.E.H.K.N.T.W.Z.].`.c.f.i.l.o.r.u.x.{.~............................................................................................... .&.).,./.2.5.8.;.>.A.D.G.J.M.P.Y.\._.b.e.h.k.n.q.t.w.z..............h.J.v.2.!.!..u.wo.".?..."....b@M..3E3...2..-!B!i!G...... ...!$!..k./......`......6./"......{h.#.....~.}.....!..U!2........}.v.}.....!...}.._..#....W"."g.%J..M".I2~.......?~.W...Z..`3.)...Ko?..h..XRQ..2.w.}.`pJ...o.@.`Dw.3.3a"7!.!..u".....hAh;3..'w."l....3...".".@..,...x......_!<J..eo_..I..}.....j..3... q.G..w...".o...".".........."."..~!.A.w.3.h....z@[3q3.@..Z.s!D......"%...w...Ww.@.2.}.`.!q.o..v...o$3....O.'..~.R...?..9..". v`dh... .R... ...........P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\sd.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6596
                                                                                                                            Entropy (8bit):4.582969781761563
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:7fiPyXjQz2RAZ9P/Vn+qmm5wbeiuXVqpJ80+PB1:7ljQz26bP9L35xrFq89B1
                                                                                                                            MD5:0CE30C563F2EF94D505E1F752FFCDFF8
                                                                                                                            SHA1:CC3FB3C19F63161FD93E1F4EFB239AD27227187B
                                                                                                                            SHA-256:FF89D7A68F20D9190F01409987A044644CDA423F5CEC3A5E06415C7A9D7DD659
                                                                                                                            SHA-512:55CB9660F862BED36E9CD18108B9F0F43F97E7CAFB609F9D4A03D64B1482D24E3485672A53C9661E76062B4566A76055C5F4DE80B81993863E2D36DBAE8CC588
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................b.. ..}.....i...i...&......}b...5K.y..4.'.E...A.,.J...J.E.F.....'.......D.J...'.}.D.J...(.J.F.F...*.1...J...,.1.3.J.../.F.J.'...D.(.J.'...F.H.H.J...G.J.}.J...~.J.1.H.....H.J.*.....(.H.F...'.3.~.J.F...'.F...J.'...'.J.1.'.F...(.J.D.J.2...*.H.'.D.H...,.1.E.F.J...,.E.J...'...3.1.(.J.'...3.E.H.&.'...9.1.H.(.'...E.'.D.}.'...E.J.'.*.J...E...'.&.H...F.'.1.H.J...F.J.~.'.D...J.H.'.J.3...J.H.F.'.F...}.H.F...'...~.D.'.&.H...~.F.'.E.'.....H.}.'.F.....J...J.'.....'.F...H.....J.F.J.'.....J.H.(.'.....G.'.F.'...".4.}.1.J.'...(.1.'.2.J.D...(.1.H.F...J...(.G.'.E.'.3...(.J.D.,.J.E...(...D.'.1.3...,.'.1.,.J.'...1.H.'.F...'...2.J.E.(.J.'...3.'.&.~.1.3...3.H.&.J...F...4.J. .4.D.2...A.D.~.'.&.F...D.'.*.H.J.'...D.J.3.H...H...D...H.F.J.'...E.'.D.'.H.J...E.'.D./.J.~...E.H.1.H...H...E.H.1.J.4.3...E.H.F.'...H...F.'.&.J.,.1...G.F...H.1.3...H.J.*.F.'.E...J.H...1.J.F...J.H...F...'...~.H.D.J.F.......&.F.'...'.....1.(.'.*.J.....H.3.H.H.H.....J.E.1.H.F.....1.J.F...'.....H.1.F.3.J.....J.E.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\seh.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2040
                                                                                                                            Entropy (8bit):5.5574526262727675
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:TlBFHqF4BJ+1GY5PT5K7mkXWa9D5Heq9vC8:TlBFFJc1kXF9D5+kvC8
                                                                                                                            MD5:357354C43E9AD4E7C379B2D645F8D2E1
                                                                                                                            SHA1:BF16478ED6FD6BCB1B2D25D6A7E98CA90FAF843D
                                                                                                                            SHA-256:4ED998147051D8CCA697A887E9781136BEF990899C4FAD009875AC3FD3D6C67C
                                                                                                                            SHA-512:02A9217D79FC1B392818E4D3802463978A91C02AE649F6650F22D1D4479B9048513D0138FBEC87276E7599F0A133E6CC932B2D110DAA92AD1FCFC55C02EF8B3E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..........................5K.y..I.r.....O.m.....B.u.t...o...C.h.a.d.e...E.g.i.t.o...G.a.b...o...I...m.e.n...J.a.p...o...S.u.d...o...S.u.....a...G.r...c.i.a...G...m.b.i.a...I.r.a.q.u.e...M...n.a.c.o...Q.u...n.i.a...S.u...c.i.a...V.i.e.t.n.....Z...m.b.i.a...A.l.b...n.i.a...A.r.g...l.i.a...A.r.m...n.i.a...C.a.m.b.o.j.a...C.r.o...c.i.a...E.s.p.a.n.h.a...E.s.t...n.i.a...G.e...r.g.i.a...H.o.l.a.n.d.a...H.u.n.g.r.i.a...L.e.t...n.i.a...M.a.l...s.i.a...M.i.a.n.m.a.r...P.o.l...n.i.a...R.e.u.n.i...o...R.o.m...n.i.a...U.c.r...n.i.a...A.l.e.m.a.n.h.a...C.o.l...m.b.i.a...E.r.i.t.r...i.a...I.s.l...n.d.i.a...J.o.r.d...n.i.a...L.i.t.u...n.i.a...M.a.u.r...c.i.o...Z.i.m.b...b.u.e...C.i.n.g.a.p.u.r.a...M.a.c.e.d...n.i.a...C.a.s.a.q.u.i.s.t...o...G.r.o...n.l.a.n.d.i.a...G.u.i.n... .B.i.s.s.a.u...I.l.h.a.s. .C.a.i.m.a.n...C.o.r...i.a. .d.o. .S.u.l...C.o.r...i.a. .d.o. .N.o.r.t.e...B...s.n.i.a.-.H.e.r.z.e.g.o.v.i.n.a...I.l.h.a.s. .T.u.r.k.s. .e. .C.a.i.c.o.s...S...o. .C.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\sq.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6352
                                                                                                                            Entropy (8bit):4.4951873853187125
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:a2mNnLb6/ifMjup2by/koDRDJyvRJqpJ8gmOL2q9yc:gNnLb6/SMjJ+rVIRJq8gmxq9yc
                                                                                                                            MD5:3999867480C307F863F863BC0B991EA2
                                                                                                                            SHA1:D1D3F671714F6C4EA8B0062635F14FFD01086651
                                                                                                                            SHA-256:570AE9E16ED52A366253757650860ECCA1C5B0C2D33BEF9F3E89D53DEF3DCD72
                                                                                                                            SHA-512:B19F5676B92E7879CFFCEA37202934B29EFE00C62D7AE61D7317D9B725FB55C97669854402591699E52677384FC99C1B103070CFF8932331A314475EFA9AB3BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................%.. ........,...,...&.......%...5K.y..M.B...A.z.i...O.K.B...S.H.B.A...B.o.t.a...G.a.n.....I.n.d.i...K.i.l.i...K.i.n.....K.u.b.....R.u.s.i.....e.k.i...A.r.u.b.....F.i.x.h.i...G.r.e.q.i...M.a.l.t.....Q.i.p.r.o...S.e.r.b.i...S.u.e.d.i...T.u.r.q.i...A.f.r.i.k.....A.n.g.o.l.....A.u.s.t.r.i...B.e.l.i.z.....E.g.j.i.p.t...E.t.i.o.p.i...E.v.r.o.p.....F.r.a.n.c.....J.a.p.o.n.i...K.o.s.o.v.....K.r.o.a.c.i...L.i.b.e.r.i...M.a.j.o.t.....N.i.g.e.r.i...O.q.e.a.n.i...P.o.l.o.n.i...R.u.a.n.d.....S.p.a.n.j.....U.g.a.n.d.....Z.v.i.c...r...A.l.g.j.e.r.i...A.m.e.r.i.k.....A.n.d.o.r.r.....A.n.g.u.i.l.....B.a.h.r.e.j.n...B.e.r.m.u.d.e...G.e.r.n.s.e.j...G.r.a.n.a.d.....G.u.a.j.a.n.....H.o.l.a.n.d.....I.r.l.a.n.d.....I.s.l.a.n.d.....J.o.r.d.a.n.i...K.a.r.a.i.b.e...K.i.r.g.i.z.i...K.o.l.u.m.b.i...L.i.t.u.a.n.i...M.a.l.a.j.z.i...M.e.k.s.i.k.....M.o.l.d.a.v.i...U.k.r.a.i.n.....X.h.e.r.s.e.j...X.h.i.b.u.t.i...A.u.s.t.r.a.l.i...B.e.l.g.j.i.k.....B.o.t.s.v.a.n.....B.u.l.l.g.a.r.i...D.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\sr_Latn_XK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):140
                                                                                                                            Entropy (8bit):4.434946620953675
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tl7T2l/LlVtlDB91kQyWn2b9ydEsSOT/59In:Svul/z1Do9ydZTR+n
                                                                                                                            MD5:45AA8BDBC6F5576977C83315D2BF720F
                                                                                                                            SHA1:09987D3C1E0C7A886B36AA514C63255C6F18BE33
                                                                                                                            SHA-256:D3630A23CEF696E3ED9C0BAE4AB59CAC0FAC9643722AAE1EF73BC2575C8DCA47
                                                                                                                            SHA-512:5DBA4852D1F7BC03C42D9BC508531AA2A19409261FC1BCD03DC27D750132A7F73EBAD6B8B7130CB28C1A458778A3FD94D20D79CA9B78F59697A212A7D41E5280
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .0....................0.....5K.y......".......Q.....S.e./..:6a.OWx..>..A;.U...E..Z.............P...P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\sr_ME.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.945547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/diwlLMA+AhP:SBtkJYlU8g8l/pJAAhP
                                                                                                                            MD5:2D9DF8911DF2B0FC2BD46D6857BBB065
                                                                                                                            SHA1:442DD9E181E28E00063B9DEF049793B57B29298B
                                                                                                                            SHA-256:7EC1F71F3D66BBCB1DE49F5E1D224A51C518B3A879C0E2FECE8FA0DD4E5F3D9E
                                                                                                                            SHA-512:06CED877FE74F372F67AA3802414849100D27F2521028A44B4F2A2D40BCBA2B8E114DF9F386E9240403CA142EB69CDEF2D1519E71DDBA012A4E85DD0BE99A5EE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y..s.r._.L.a.t.n._.M.E...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\sr_YU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9159246284584364
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMwt6E7l9tQksAQn:Svbt6gfo
                                                                                                                            MD5:5C56677A0822B6F922124F4E4AE5A625
                                                                                                                            SHA1:D1A78F3F6F949CA8C8593DFD24A8C248642BBF38
                                                                                                                            SHA-256:7D0E61F3CA3DAE5BB75AAF6318BDE4F128DA9662FE1D75FC245F5D4B5E4188CE
                                                                                                                            SHA-512:0090C31C35AF1B6718F4DB3FE7AA2E6F06240B7895DF417FF9500E08C66A9F9D98095378558131C2D96EA129FDC7DF30BE876F4B18B887872B0ADDFA9C3A59A8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..5....................5....5K.y.......5

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\sw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4088
                                                                                                                            Entropy (8bit):4.9424596896562925
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:M59Bgw27HPqAKMUw09nChvvMDqTxx462sN6nyWglONjPRtk5dR2BlNnqpZXXZJ8E:twqHPqFutxHS5x1qppH8nzbtfuvv
                                                                                                                            MD5:19A9BE91745F74598CE1F90F209D6FBC
                                                                                                                            SHA1:630727BB3E032E4A3C8AE95B6FDE963BDEA5E350
                                                                                                                            SHA-256:C8DAFBFEAB89E53C9521B8FFD5ACCF85477A22048CE1251138332D5A9EAC0D69
                                                                                                                            SHA-512:DC50610B3A03E628C918B10746C329E340B9D94D184D57F655236F685EEFA0A7AF1C8029ED34D4E7B351FB347330FD9A6F8133373A099CB78FC267F1C9CE375D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .[..............$.....[.....5K.y..E.Z...S.a.u.d.i.a...U.c.h.i.n.a...C.h.e.c.h.i.a...A.n.t.a.k.t.i.k.i...A.z.e.r.b.a.i.j.a.n.i...K.o.n.g.o. .(.D.R.C.)...A.s.i.a. .y.a. .K.a.t.i...S.u.d.a.n. .K.u.s.i.n.i...U.m.o.j.a. .w.a. .U.l.a.y.a...A.m.e.r.i.k.a. .K.u.s.i.n.i...A.s.i.a. .y.a. .K.u.s.i.n.i...K.i.s.i.w.a. .c.h.a. .M.a.n...M.j.i. .w.a. .V.a.t.i.c.a.n...O.c.e.a.n.i.a. .y.a. .N.j.e...A.m.e.r.i.k.a. .y.a. .K.a.t.i...U.l.a.y.a. .y.a. .K.u.s.i.n.i...U.m.o.j.a. .w.a. .M.a.t.a.i.f.a...A.f.r.i.k.a. .y.a. .K.u.s.i.n.i...C.e.u.t.a. .n.a. .M.e.l.i.l.l.a...G.u.i.n.e.a. .y.a. .I.k.w.e.t.a...J.a.m.h.u.r.i. .y.a. .K.o.n.g.o...S.a.h.a.r.a. .M.a.g.h.a.r.i.b.i...V.i.s.i.w.a. .v.y.a. .A.l.a.n.d...V.i.s.i.w.a. .v.y.a. .F.a.r.o.e...W.a.l.l.i.s. .n.a. .F.u.t.u.n.a...A.m.e.r.i.k.a. .K.a.s.k.a.z.i.n.i...A.s.i.a. .y.a. .M.a.g.h.a.r.i.b.i...A.s.i.a. .y.a. .M.a.s.h.a.r.i.k.i...K.i.s.i.w.a. .c.h.a. .B.o.u.v.e.t...V.i.s.i.w.a. .v.y.a. .C.a.y.m.a.n...V.i.s.i.w.a. .v.y.a. .K.a.n.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\teo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):984
                                                                                                                            Entropy (8bit):6.661154181241089
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:xmrJVJ7OkJBvWa9D2h1i/veBQ+7TTKO54TKc2hdl/QZ:xMmkXWa9D5HeXTb4TSqZ
                                                                                                                            MD5:B251EE0ACDC0B3C19A8AEC4F7E60716A
                                                                                                                            SHA1:3D3C11DC2C078E1AC0E3C47D81196701A518FD36
                                                                                                                            SHA-256:ADAD45BF179A3143B7CAD5600B1A239110179B41892B25258805C9CCD8599380
                                                                                                                            SHA-512:B03EC25DB14401F5D29FDF344CF5322450863B9453348521F6AE94BDFABB38759A8935C51BA871B9D291D17E1F533863FB636EA25DEADF0AAAAEDDBBD3883C69
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..........................5K.y..............................................................................................".+...1.7.:.=.@.C.I.L.O.U.X.[.d.g.j.m.s.v.y.|...............................................................................................!.$.'.*.-.0.3.6.?.B.E.H.K.N.T.W.Z.].`.c.f.i.l.o.r.u.x.{.~............................................................................................... .&.).,./.2.5.8.;.>.A.D.G.J.M.P.Y.\._.b.e.h.k.n.q.t.w.z..............h.J.v.2.!.!..u.wo.".?..."....b@M..3E3...2..-!B!i!G...... ...!$!..k./......`......6./"......{h.#.....~.}.....!..U!2........}.v.}.....!...}.._..#....W"."g.%J..M".I2~.......?~.W...Z..`3.)...Ko?..h..XRQ..2.w.}.`pJ...o.@.`Dw.3.3a"7!.!..u".....hAh;3..'w."l....3...".".@..,...x......_!<J..eo_..I..}.....j..3... q.G..w...".o...".".........."."..~!.A.w.3.h....z@[3q3.@..Z.s!D......"%...w...Ww.@.2.}.`.!q.o..v...o$3....O.'..~.R...?..9..". v`dh... .R... ...........P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\th_TH_TRADITIONAL.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.00791013918967
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtldelFal9lYuBFQlj/Ohc7H1:SBtkJUlY4KwEyH1
                                                                                                                            MD5:5B0B7B55B3DDAC3A9199B9DBB8F0A86F
                                                                                                                            SHA1:DB9B7612D73CCB089B83F9D8A6D2124201173911
                                                                                                                            SHA-256:7BEA1755CCCB0764FD7EFE6453176624CEE438B0F2C2DC5FC5806F96FFB8C0B3
                                                                                                                            SHA-512:2307C00F4F155694E7868E8670B75072428BE29D906ADCA2F526C31ACBC25D72EAD08C903ECACB64070CA34F7889AE46FD6E516BEBD16B4EE9A9F4CCB0810BC7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................5K.y..b.u.d.d.h.i.s.t..................P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\tl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9223749573488704
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMJ06E7lRlldsdn:Sv/6gy
                                                                                                                            MD5:BA8F4166B092D8AD816001D2BCBBB85E
                                                                                                                            SHA1:621D56098BCB62B4DCFD93B7AEBA908D370CA4EF
                                                                                                                            SHA-256:54853C8D23B15997DE0DC56918289149F5DD7588B198CEEDB1B615AE0AE7A234
                                                                                                                            SHA-512:C5B4FBC148BB5BB2DC5012BBD4BEC68E5720B1E53F3B09B56E040432EA4E623384A608262B17EDD7D68F9A6502058270AF2EE4072578C7931F2053FB39C2863C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.sb...................sb....5K.y......rb

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\tl_PH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):92
                                                                                                                            Entropy (8bit):2.8199785675133215
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlF112lYlillq85f91DP:SBtkJclIilLf9tP
                                                                                                                            MD5:A3693BCEFC128E317A8A84A488BDFB57
                                                                                                                            SHA1:8E39330E6424CADCF3307DF868CC200D0817FD5A
                                                                                                                            SHA-256:E12BBD6A876437281EBD1D21E1BB7185BF8B74B2A2DF71F33E81D35EA9ACB4FA
                                                                                                                            SHA-512:03AB84FFC913A6259FB292DD52DD54603349D9606FA84FB759C69246FA37FDDB8A4E956D9ECC8FFB483596809A5B919961ABD82202F73AE57FFD27D2CA956018
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y..f.i.l._.P.H...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\to.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8200
                                                                                                                            Entropy (8bit):4.188608669078113
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:yLM/lG6UmhU82ziUBhPG4QocO1NE8ajCqEH3qpJ8/NVL:y6QU129gOPXajCLXq8FVL
                                                                                                                            MD5:E32CC09902CA3333C74C6E9EBA80CC9E
                                                                                                                            SHA1:F4E671C3FCB1ED8FA37842869A71074BC62C4375
                                                                                                                            SHA-256:C2E226113288A9CBF7E91826E59AC580E245DCB43470D7E25A31CF54BD65965E
                                                                                                                            SHA-512:D7CC8C3A17FF0AFDCA57564F477A0B2837A95B19FB30CE286A098FC099A8385AEBFB09F0B7A2505FF5C0C3833878DB9793BF7E9AE05B55969A86F10842F4A125
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .;..............#.....;.....5K.y..L.a.u...F.i.s.i...K.a.n.a...K.a.t.....M...l.i...N.i.u.....P.e.l.k...S...t.i...T.o.k.o...K.e.n.i.....K.i.u.p.a...K.u.a.m.u...L.+.p.i.a...N.i.s.i.a...N.o.a.u.....S...k.i.a...S...p.i.a...S.+.l.i.a...T.o.a.k.e.......s.i.a...H.M.l.a.n.i...I.e.m.e.n.i...K.a.l.i.s.i...K.a.p.o.n.i...K.u.e.i.t.i...K.u.i.a.n.a...K...n.a.t.a...K.M.s.o.v.o...M...m.a.n.i...P.a.h.a.m.a...P.a.n.a.m.....P.e.l.i.s.e...P.e.n.i.n.i...P.o.l.a.n.i...P...m.u.t.a...P.k.t.a.n.i...S.e.l.u.s.+...S.e.M.s.i.a...S.i.p.u.t.i...S.k.t.e.n.i...T.k.v.a.l.u.....A.l.u.p.a.....*.t.a.l.i...H.a...a.m.o.a...K.a.m.i.p.i.a...K.u.e.n.i.s.+...K.u.l.a.s.a.o...L.o.m...n.i.a...L.u.a.n.i.t.....M.a.l...s.i.a...N.a.m.i.p.i.a...P.a.l.e.i.n.i...P.o.l.+.v.i.a...P.u.l.u.n.e.i...S.a.m.a.i.k.a...S.e.m.i.p.i.a...S.i.a.m.a.n.e...S.i.a.p.a.n.i...S.i.p.e.i.n.i...S.o.a.t.a.n.e...S.u...t.e.n.i...S.M.m.a.l.i.a...T.a.i.l.a.n.i...T.a.i.u.a.n.i...T.u.n.+.s.i.a.....E.u.l.o.p.e.....I.l.a.a.k.i.....I.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\tr.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5712
                                                                                                                            Entropy (8bit):4.653528254810595
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:11lbKGCrJj3azVrvUiLOH4fxSiqh/rQSoetMMLSyxc8ND6//eg50DqppH8nzbfQh:11irJTaN5LOsxSiI/rQSoeaMLSOc8NGN
                                                                                                                            MD5:A22C8797E62A97E39371826659F8B222
                                                                                                                            SHA1:CDC095E9C0DA848D20E1852850C5DDC1A8B5DA34
                                                                                                                            SHA-256:076A2751183CB9ECCB360F3248F40A42AD32B3D1138EBC7230F192A64D4273F9
                                                                                                                            SHA-512:524EDB17C284FAA049862F2F556ACD20615E9F282CDF2393130CBF731F5FDF14C34AFB776B59DDC1CE034E0082DC1EF4D9315F89512D1A09CB1E2B59C47D6787
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................$...........5K.y..B.K...B.M...A.B.D...F.a.s.....i.n...K...b.a...0.r.a.n...^.i.l.i...D...n.y.a...M.1.s.1.r...R.u.s.y.a...T.u.n.u.s...U.m.m.a.n.....e.k.y.a.....r.d...n...0.s.v.e.....C.i.b.u.t.i...K.o.s.o.v.a...K.u.v.e.y.t...K.1.b.r.1.s...L...b.n.a.n...N.o.r.v.e.....S.u.r.i.y.e...0.s.r.a.i.l...0.t.a.l.y.a...B.a.h.r.e.y.n...B.e.l...i.k.a...B.o.l.i.v.y.a...C.e.z.a.y.i.r...E.s.t.o.n.y.a...J.a.p.o.n.y.a...K.a.r.a.d.a.....L.e.t.o.n.y.a...N.i.j.e.r.y.a...P.o.l.o.n.y.a...R.o.m.a.n.y.a...T.a.y.l.a.n.d...T...r.k.i.y.e...U.k.r.a.y.n.a...0.r.l.a.n.d.a...0.s.p.a.n.y.a...0.s.v.i...r.e...0.z.l.a.n.d.a...A.r.j.a.n.t.i.n...B.r.e.z.i.l.y.a...E.t.i.y.o.p.y.a...F.i.l.i.s.t.i.n...H.o.l.l.a.n.d.a...K.a.m.b.o...y.a...K.o.m.o.r.l.a.r...L.i.t.v.a.n.y.a...P.o.r.t.e.k.i.z...S.l.o.v.a.k.y.a...S.l.o.v.e.n.y.a...T.a.n.z.a.n.y.a...B.a.t.1. .A.s.y.a...A.v.u.s.t.u.r.y.a...B.a.h.a.m.a.l.a.r...D.o...u. .A.s.y.a...E.n.d.o.n.e.z.y.a...G...r.c.i.s.t.a.n...M.a.l.d.i.v.l.e.r.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\tzm.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4912
                                                                                                                            Entropy (8bit):4.4248206727410295
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:eIe8ZPFcykYhd4+gk0kStLGl/E782qiNhXXf0m208EmkU0kXF9D5+lm+6LrPj:O+PFcyksdMk0kStLA/n2qiNhXXf0xmx+
                                                                                                                            MD5:6032FAE8B1E0526E2D7EF9DEF5E7DCA0
                                                                                                                            SHA1:FE8CD9B123898A4B74B4A5480C1B5DADFEF04D43
                                                                                                                            SHA-256:6BE93B4EA4F2090C99699A60248936B38C6041A146D4BAD25FA856EA9352596A
                                                                                                                            SHA-512:35B6BD0B7231A788BE7FB51D45B0A79BCB79CDEFB2A725C7F5B1B277948E748C053B672C2E0DB67E8D3A9152EBEABD57200A17FD8111A138069140C603B3E295
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................5K.y..H.i.n.d...L.a.w.s...M.i.c.r...N.i.w.i...P.i.r.u...T.c.a.d.....a.n.a...b.c.i.n...B.i.l.i.z...B.u.m.a.n...C.c.i.l.i...H.a.y.t.i...K.i.n.y.a...M.a.l.m.a...M.a.y.u.m...M.u.r.i.s...N.a.w.r.u...Q.a.m.a.r...Q.u.m.u.r...R.u.s.y.a...S.a.m.w.a...S.u.r.y.a...T.u.k.l.u...T.u.n.e.s...U.r...u.n...Y.u.n.a.n.....i.r.a.q.....i.n.y.a...l.u.n.g.a...l.m.u.g.u...A.n.g.u.l.a...B.r.u.n.a.y...B.[.a.z.i.l...D.z.a.y.e.r...F.[.a.n.s.a...I.m.a.l.y.a...L.i.s.u.m.u...M.a.l.d.i.v...M.e.[.[.u.k...M.i.k.s.i.k...M.u.n.a.k.u...N.i.p.p.a.l...N.n.i.j.e.r...Q.u.b.r.u.s...S.b.a.n.y.a...S.s.i.c.i.l...S.s.u.d.a.n...S.w.i.s.r.a...T.u.r.k.y.a...U.c.a.n.d.a...V.i.m.n.a.m.....u.m.m.a.n.....i.b.u.t.i...b.c.u.m.a.l...l.a.y.w.a.n...l.u.v.a.l.u...A.l.b.a.n.y.a...A.n...u.r.r.a...A.r.m.i.n.y.a...B.a.%.r.a.y.n...B.e.l.j.i.k.a...B.i.r.m.u.d.a...B.u.l.i.v.y.a...G.r.i.n.a.d.a...H.u.l.a.n...a...I.k.w.a...u.r...I.r.i.t.r.y.a...I.r.l.a.n...a...I.s.l.a.n...a...I.s.r.a.e.i.l.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\uz_Cyrl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4916
                                                                                                                            Entropy (8bit):5.022526314614901
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:pEnEdx+Rl2NYo9y4W/86jkBddmCO2XOqpPH8nWYAG91Mj2Prv:pEKx+RE9xtldMCEqpv8rJPL
                                                                                                                            MD5:1731FF68868390BBEDF798EC2A13215A
                                                                                                                            SHA1:52B37FD031B2B76A98AADCA8E20A9626BBD30AA0
                                                                                                                            SHA-256:17B782ED0B9C5B1C318F1F7399BD97DBB4C5468156613406F528AB8C72AAF034
                                                                                                                            SHA-512:ECC9CFF8005D9D059DF9018A3CACFFBE56E96BACA20D6ACEB160CDA27C94FE37A166131388D7A75B90822C392B2F2FB0115627D576541CDB1172D64B97F4ADE8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .U..............!.....U.....5K.y......(.....C.=.Q.....@.>.......8.A.@...$.8.6.8...-.@.>.=.../.<.0.=...!.C.@.8.O...#.<.<.>.=...%.8.B.>.9.....0.B.0.@.....0.7.>.8.@.....8.1.C.B.8.....A.@.>.8.;...".C.@.:.8.O.....C.2.0.9.B.....0...@.0.9.=.....0.@.>.:.0.H... .C.<.8.=.8.O.....>.:.8.A.B.>.=...$.0.;.0.A.B.8.=.....>.B.A.2.0.=.=.0.....M.=. .>.@.>.;.8.....8.=.4.8.A.B.>.=.....7.1.5.:.8.A.B.>.=.....C.2.5. .>.@.>.;.8.....7.0.@.1.0.9.6.>.=...".>.6.8.:.8.A.B.>.=.....>.7.>...8.A.B.>.=.....0.@.1.8.9. ...A.8.Q.....0.=.C.1.8.9. ...A.8.Q.....C.:. .>.@.>.;.;.0.@.8.....5.J.@.>.6. .>.@.>.;.8...(.0.@...8.9. .".8.<.>.@.....C.N.:. ...@.8.B.0.=.8.O.....=.4.>.H. ...:.5.0.=.8.O.....0.=.C.1.8.-...D.@.8.:.0...(.0.@...8.9. ...2.@.>.?.0.....0.=.C.1.8.9. .!.C.4.0.=.....0.=.C.1.8.9. ...>.@.5.O.....0.@.8.1. ...0.2.7.0.A.8.....0.@.:.0.7.8.9. ...A.8.Q...(.0.@...8.9. ...D.@.8.:.0...(.8.<.>.;.8.9. ...>.@.5.O.../.=.3.8. ...5.;.0.=.4.8.O.....0.@.1.8.9. ...D.@.8.:.0.....0.@.1.8.9. ...2.@.>.?.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\vai_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):5152
                                                                                                                            Entropy (8bit):4.476373714928377
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:mlEhvV/y1dxNRgs9rY9nmIauhrO057HiMhPmq46eEKGnVb4KXiE6M40f5wsBRpk2:mkUdbacrMrr1qenVUMbH40f6JFRGRWWp
                                                                                                                            MD5:85F8AD6E7E0F7AECDED5C2D6B77FC9FF
                                                                                                                            SHA1:A38276921E0D5D5A3B1DC9BDB334EE71E1EE739D
                                                                                                                            SHA-256:31B0F5518E3A11BB007A174DDDD9110F3AEF72C20E721AF3B343CEADA5B26010
                                                                                                                            SHA-512:1492DC59D0A84B2B405AE21510962A79141B08990ADAA85FBF36F59458DB973CCD8D95BF59369AB75E9E6C36F42ED359344F55AAFFEA56B117E73950D4584303
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .Lo...................Lo....5K.y..P.o.o...F...j.i...N.e.p.a...N.i.w.e...N.o.r.u...P.a.l.o...P.[.r.u...B.h.[.n.i...C.h...d.i...C.h...l.i...F.[.K.s.i...H...i.t.i...H.[.l.[.K...J.a.m...)...J.a.p.a.K...K...n.y.a...K...n.g.o...N.a.).j.a...N.T.T.w.e...P...l.[.K...S.u.d.[.K...S...y.a.K...T.T.n.g.a.....t.a.l.i...A.K.d...r.a...A.K.g...l.a...A.K.g...l.a...B.h.a.r.[.K...B.h.e.l.i.z...B.h.u.t.a.K...C.h.....n.a...F.i.K.l.[.K...G.a.b.h.T.K...G.u.w.a.m.i...J.T.T.d.a.K...K.a.t.a.h.a...K...n...d.a...L.a.h.a.b.u...L.i.s...t.o...M.a.v.o.t.e...M...s...l.a...M.T.n.a.k.o...M.T.r.o.k.o...M.[.s...k.o...P.a.n.y.[.)...S.e.s.h.[.[...T.a.i.w.a.K...T.u.v...l.u...W.a.l...s.i...Y.e.m.[.n.i.....n.d.i.y.a...A.g.i.r.i.y.a...A.m...n.i.y.a...B.h.[.m.u.d.a...F...l.e.p.i.K...H.T.n.d.u.r.a...J.i.b.h.u.t.i...J.T.T.j.i.y.a...K.a.m.e.r.u.K...K.i.y.u.b.h.a...L.e.b.h.a.n.T...L.e.b.h.i.y.a...L.u.s.i.m.b.T...M.T.r.e.s.h.T...N.i.d.T.l.[.K...P.a.r.a.g.T.e...P.i.t.i.k.[.K...P.o.t.o.k...i...R.a.w.u.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\vi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4712
                                                                                                                            Entropy (8bit):5.124600475152206
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:rl+Vu38cUfpZrr1FjxlsqppH8nzOjm7EHE:rl+VVH/IqpJ8ES
                                                                                                                            MD5:E9AEB0AE15539E723009F72D594197CE
                                                                                                                            SHA1:BAAA2B5F5271B8448E34D25783F538AFCBD68098
                                                                                                                            SHA-256:10BFF4B83DC15A8CD820352E5DBC48659F2B56C4FEF36128FEC70BD6D09B7E39
                                                                                                                            SHA-512:5D962958CD7D68B460393BDC797FD3FE9E06EC2053FCBFF747731CBD3260DB0BEB22B6150AA7F0121E0E1A3E8B2762A1150EC14F8E746BCFE25436044D664998
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................&...........5K.y..B.......o...L...o...N.g.a...S...p.......c...N.a. .U.y...T...y. .......n. .......A.i. .C...p...B.a. .L.a.n...B...c. .M.....B...c. ...u...C.h...u. .....G.r.u.z.i.a...H.y. .L...p...M.a.-.r...c...N.a.m. .M.....N.a.m. ...u...T...y. ...u.......n.g. .....B...c. .P.h.i...L.i.-.b...n.g...M...n.g. .C.....N.a.m. .C...c...N.a.m. .P.h.i...T.h...y. .S.)...T.r.u.n.g. .....T...y. .P.h.i.......n.g. ...u.......o. .M.a.n...C.a.-.r.i.-.b.....H...n. .Q.u...c...N.h...t. .B...n...P.h...n. .L.a.n...T.h...i. .L.a.n...T.h... .g.i...i...T.r.u.n.g. .M.....V.i...t. .N.a.m.....a.n. .M...c.h.......i. .L.o.a.n.......n.g. .P.h.i...C.a.m.p.u.c.h.i.a...H...n.g. .K...n.g...N.a.m. .S.u.d.a.n...T.h...y. ...i...n.......n.g. .N.a.m. .....B... .....o. .N.h.a...T.h... .N.h.). .K.....T.r.i...u. .T.i...n...T...y. .S.a.h.a.r.a.......n.g. .T.i.m.o.r.......o. .B.o.u.v.e.t...B... .B.i...n. .N.g.....T...y. .B.a.n. .N.h.a.......o. .N.o.r.f.o.l.k..... .R...p. .X...-.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\vun.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):984
                                                                                                                            Entropy (8bit):6.664654262645045
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:xmrJVJ7OkJBvWa9D2h1i/veBQ+7TTKO542Kc2hdl/QZ:xMmkXWa9D5HeXTb42SqZ
                                                                                                                            MD5:2DC65410ADD51F24840BE253B3DE1E6A
                                                                                                                            SHA1:555D4E6EB7C777E657DC6FA511950B6A31426BA1
                                                                                                                            SHA-256:E8647FD90A97C6C221DEABE0E4E4F833E3B726C9424091695E2419045D7F2B60
                                                                                                                            SHA-512:01BEC81C93895A11FDB507BCFE01386D0D590E20827AAD4AB59CE50E25DE3074801996FD2B3AC9D8231AF80049DC5ECAAB8E3AD38AE8FD9B4135706CDC53F60F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..........................5K.y..............................................................................................".+...1.7.:.=.@.C.I.L.O.U.X.[.d.g.j.m.s.v.y.|...............................................................................................!.$.'.*.-.0.3.6.?.B.E.H.K.N.T.W.Z.].`.c.f.i.l.o.r.u.x.{.~............................................................................................... .&.).,./.2.5.8.;.>.A.D.G.J.M.P.Y.\._.b.e.h.k.n.q.t.w.z..............h.J.v.2.!.!..u.wo.".?..."....b@M..3E3...2..-!B!i!G...... ...!$!..k./......`......6./"......{h.#.....~.}.....!..U!2........}.v.}.....!...}.._..#....W"."g.%J..M".I2~.......?~.W...Z..`3.)...Ko?..h..XRQ..2.w.}.`pJ...o.@.`Dw.3.3a"7!.!..u".....hAh;3..'w."l....3...".".@..,...x......_!<J..eo_..I..}.....j..3... q.G..w...".o...".".........."."..~!.A.w.3.h....z@[3q3.@..Z.s!D......"%...w...Ww.@.2.}.`.!q.o..v...o$3....O.'..~.R...?..9..". v`dh... .R... ...........P. .`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\xog.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2644
                                                                                                                            Entropy (8bit):5.091703059176713
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:CiwA19vs11DmsHoCKVDqoFbQKx9eX0mkXWa9D5HefedKDD5G0FwKDXE:h99vOhH1K5bQ08kXF9D5+fbA0FRXE
                                                                                                                            MD5:00AA27ED0CE3BDFCE88D6CF6E8CEED99
                                                                                                                            SHA1:1E585D284392D7571D764C70EC0A9B49047B5ABE
                                                                                                                            SHA-256:9D047105EA91AD8C57E97667B577F47D5C2AD0AFE33A25C63483D6D3B4AFBA5B
                                                                                                                            SHA-512:1084D8FDE1911579DDEB2F53CC19ADA97FCDA2B6A646B8E353AF6C12A56BC1E333B14DE53300C833EB956E383E5A79E03E26F7524A7BE97275A915B889327417
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .0....................0.....5K.y..L.a.s.a...N.i.j.e...N.o.w.e...C.a.a.d.i...T.t.a.k.e...C.a.y.i.n.a...G.y.o.g.y.a...L.e.s.o.s.o...S.e.s.e.r.e...T.i.m.o.w.a...Y.i.t.a.l.e...B.u.d.a.a.k.i...B.u.t.a.a.n.i...B.u.y.i.n.d.i...E.s.y.o.p.y.a...J.j.i.b.u.t.i...L.a.t.i.v.y.a...S.u.d.a.a.n.i...T.u.n.i.s.y.a...Y.i.r.a.a.k.a...Y.i.r.a.a.n.i...A.l.i.g.e.r.y.a...B.a.a.r.e.e.n.i...B.e.r.e.m.u.d.a...B.u.r.u.n.a.y.i...E.m.i.r.e.e.t.i...K.a.m.b.o.d.y.a...K.o.l.o.m.b.y.a...M.o.l.o.d.o.v.a...P.o.t.o.r.i.k.o...S.i.p.u.r.i.y.a...V.e.n.z.w.e.r.a...Y.o.r.o.d.a.n.i...S.a.w.u.d.a.r.e.b.y.a...E.b.i.z.i.n.g.a. .b.y.a. .C.a.g.o...E.b.i.z.i.n.g.a. .b.y.a. .K.k.u.k.i...G.a.y.a.n.a. .y.a.k.u. .e.k.w.e.t.a...A.n.t.i.g.w.a. .n.i. .B.a.r.a.b.u.d.a...E.b.i.z.i.n.g.a. .b.y.a. .K.o.m.o.r.o...L.i.p.a.b.u.l.i.k.a. .y.a. .C.e.e.k.a...K.o.r.e.y.a. .e.y.a. .m.u.m.a.m.b.u.k.a...P.a.l.e.s.i.t.a.y.i.n.i. .n.i. .G.a.z.a...T.u.r.i.n.d.a.a.d.i. .n.i. .T.o.b.a.g.o...E.b.i.z.i.n.g.a. .b.y.a. .M.a.l.i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\yue_CN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.852172957387978
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlgelU8gl8l/dU1l6lazlI/ko:SBtkJZlU8g8l/Wl6leGko
                                                                                                                            MD5:F028732250A08A36422C2C0F130C7D02
                                                                                                                            SHA1:089E81793292485075C360CB7206B35ABE44A19D
                                                                                                                            SHA-256:B9CE9F21DC60A7CC91FA31EACFE76C21FA35E53565FC70674E78F58E8E44211C
                                                                                                                            SHA-512:E1CE98EAD1257CB2A83FA1452AAE96A5C1A7BF4D4242C0C73FF84C405EADF18F98A6CE49ED4ACE9020AABF543F1F02005DA2AFA0E015287D8A320D1C863B25D8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y..y.u.e._.H.a.n.s._.C.N.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\yue_Hant_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/dsp:SBtkJ1li6gml/8
                                                                                                                            MD5:3F209B3AA35603DCBB208A74CAA36C86
                                                                                                                            SHA1:249DE057005BE697205333ABA0433C5B04653BBB
                                                                                                                            SHA-256:F3965E339C622C96879DEE316DE42F9E9F693DDEB7A52FDCEBBA027171F2C86A
                                                                                                                            SHA-512:02411AE5728814057E0CA78D850EEA85B3ACA16DFDBEE97A7C01860DA3B82640EEBE60960938C7F64B05D9E9FE8BAE0B826D242E24B33C40024836F716F17E31
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................5K.y........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\zh.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3880
                                                                                                                            Entropy (8bit):6.5522206645256516
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:iT+OFxAMsgbJveCkC+Bi0qppH8nzO/5WMlKqH:iT+ufbJvcCgi0qpJ8yWMf
                                                                                                                            MD5:DFBC65905ADE0CB29F2B59189AC3BECF
                                                                                                                            SHA1:9E53E80F93A050F81B4C3D1179BF543061851317
                                                                                                                            SHA-256:36CB99D4EDAB58B15D74D716882F50C1602B72B84B30C34811DF4F104D31E6BA
                                                                                                                            SHA-512:15380E93E7D4B0A51E3FC945B778989E798C159ABC136689D8203ECD9F31510AD60C236D88C8631312E8E718CC90B7189BFEAE97E304CE650FE2FCA928596929
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..2.............&......2....5K.y.....V....V...N9N...N.N...N'k...N^...-N.N..-N.V..-N^...9N....MN._.._N....N2m...O.g..sQ.\...Q.\...R.~...R....S'k...S^...WS'k..WS^...pS.^...S.]...S~n...W.S...Y.T...].g...].....^J....^.R..._.V..*c.Z..wcKQ...e.....eNm..zf)R...g....'k2m..'k.v..dl.R...l.V...lpQ...l.V..wm0W...o...Yt....^txQ..^t.X...y.....~.e...~.W....8u.....c....pQ..w.pQ.....S....'k....^......[....WS..?..f....V...q\..T..T.V...NWS.N..WS.9N.."}l.....N.^vl..-N..2m..LNKQpQ..LNr^....LN.b-W..*O0W:S../O)RyQ..[O._....Q.k.N..)R.k.N..WS.g2m..aSTX.\..bS.e....bS.h!X...S)R.N...T.^.c...U.......V.tbS..#W..\..^X...\..eY0W)R...[-W.b...[S..\..<\.e.\..<\.l.\...].Tl....].bl....^......^.\...^.b"}...a'Y)R..XbKQ.R..id.~.T...e..pQ..9h...\..<hu.pQ...h...Q..'kCQ:S...k)R.e...l...\..1r.\pQ..YrpN.R..Yu<\jl..~vUa'Y...yidW....z<\.e....<\.N....WS...."}Xb..._.[..^..k.N..?....]..l.i`.\..l..b.~..l..~yr..l.3..N..}v.OW..e..WS.^.2m..l.eg...N...N..<\.N...O.R)R.N..KQW.0W.N..)R.k.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rm.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3400
                                                                                                                            Entropy (8bit):5.791705989472858
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:hzh55C8gXlYi8+qZGDanf+ilCAx6wEmzKYW3F:nr/ianWi4+sAKYW3F
                                                                                                                            MD5:2E5F67F78288205A57C9D007678F91E4
                                                                                                                            SHA1:58F076D147C9401C74E48CFDC222D0857C0D3D22
                                                                                                                            SHA-256:7F7B201F51FE1228F46B4CDEBC228F838C4B3D746D64C37C43FB76CACE3A9273
                                                                                                                            SHA-512:BCEB142E37C9EEB752D233CF8EFA7E403BB0547F30C30230EBEBE1C2D04ECE512E07185C5D8F7D63071E921B6982641449EBF4B5A76B7411E885EF6C7FC034A3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................:.. .%......J...J.../.....%.........v.e...o.z...g.i.e...g.l.i...o.n.n...u.r.a...m.a.t.g...f.a.n.....m.a.i.s...a.v.u.s.t...s.e.t.t.....s.o.n.d.a...e.p.o.c.a...a.v.r.i.g.l...f.a.v.r.e.r...s.c.h.a.n.....z.e.r.c.l.....d.a.m.a.u.n...s... .C.r.....f.a.n.a.d.u.r...g.i.e.v.g.i.a...m.e.s.e.m.n.a...o.c.t.o.b.e.r...s.c.h.a.n.e.r...a.v... .C.r.....e.n.g.l.a.i.s...s.e.c.u.n.d.a...s.t.e.r.s.a.s...d.u.m.e.n.g.i.a...v.e.n.d.e.r.d.i...g.l.i.n.d.e.s.d.i...s.e.t.t.e.m.b.e.r...z.e.r.c.l.a.d.u.r...p.u.s.c.h.m.a.u.n...d.i. .d.a. .l.. e.m.n.a...z.o.n.a. .d.. u.r.a.r.i...a.v.a.n.t. .C.r.i.s.t.u.s...m.e.s.a.d.a.d. .d.a.l. .d.i...s.u.e.n.t.e.r. .C.r.i.s.t.u.s...E.E.E.E.,. .'.i.l.s.'. .d. .'.d.a.'. .M.M.M.M. .y...E.E.E.E.,. .'.i.l.s.'. .d. .'.d.a.'. .M.M.M.M. .y. .G...?.[... ... ... ... ... ... ... ... ... ... ... ... ... .-. ... ... .+. ... ... .O. ... ... ... .M. .S. ... .m. ... ... .k. ...]...A.[.A. ... .B. .C. .D. .E. ... ... .F. .G. .H. .I. ... .J. .K. .L. .M. .N. .O. ... .

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2060
                                                                                                                            Entropy (8bit):4.934466690789509
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:m+SqFfc7SnplEwD3Pt/SNOofqP5pQKVNdQKoQKAQVPgGGhiRP+g/3hutuVdzK:z5u7MpewD39/iqRuKaKdK1VP9x+g/3wD
                                                                                                                            MD5:9E079C4A48B157D36285090C71188F8F
                                                                                                                            SHA1:14A8149C73B70011BA44D7AAFBB7483170D0B052
                                                                                                                            SHA-256:02068A32035EEC4FE65408983B67961657254819FFE879EBA9F5E6CC6FBE2377
                                                                                                                            SHA-512:2F68DA198A90A408CD29ECB503D909E782F3C4B8C0611B09991E244782F9A482D22FF5D0F98B0E146DF18069EEFE3D1811721239DA59A3FC1397C412E45CA5E1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .m....................m.........I.1...I.2...I.3...I.4...c.u.....G.a.s.....G.i.c.....K.a.m.....K.a.n.....M.a.t.....M.u.t.....N.y...Y...N.y.a.....N.z.e.....U.g.u.....U.k.u.....U.k.w.....W.e.r.....g.n.d.....g.n.u.....g.t.u.....k.a.b.....k.a.n.....m.b.e.....Z...M.U.....Z...M.W.....I.g.i.h.e...I.s.a.h.a...M.b...Y.....N.z.e.r.o...U.m.u.s.i...R.u.s.a.m.a...U.k.w.e.z.i...U.m.w.a.k.a...M...s./.N...s...R.u.h.e.s.h.i...U.m.u.n.o.t.a...G.i.t.u.g.u.t.u...I.s.e.g.o.n.d.a...K.i.g.a.r.a.m.a...M.u.k.a.k.a.r.o...M.u.n.y.o.n.y.o...N.y.a.k.a.n.g.a...R.u.h.u.h.u.m.a...U.y.u. .m.u.s.i...N.d.a.m.u.k.i.z.a...N.t.w.a.r.a.n.t.e...K.u. .w.a. .k.a.n.e...K.u. .w.. i.n.d.w.i...N.y.a.n.d.a.g.a.r.o...K.u. .w.a. .m.b.e.r.e...E.j.o. .(.h.a.h.e.z.e.)...E.j.o. .(.h.a.z.o.z.a.)...K.u. .w.a. .g.a.t.a.n.u...K.u. .w.a. .g.a.t.a.t.u...K.u. .w.a. .k.a.b.i.r.i...I.n.d.w.i.,. .I.y.i.n.g.a...M.b.e.r.e. .y.a. .Y.e.z.u...N.y.u.m.a. .y.a. .Y.e.z.u...I.m.i.n.s.i. .y.. i.y.i.n.g.a...K.u. .w.a. .g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ro_MD.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1012
                                                                                                                            Entropy (8bit):4.635795293435391
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:kOTC7wOLMZ4i5PVW/gvV2ffaA/aAAXP7hUqp9Zf+jnW:kp7tLo4i5PVW/gvV2ffn/nIaW
                                                                                                                            MD5:D4145C815EFC76FA1CC41C861616F59D
                                                                                                                            SHA1:3D2FF1AE6BAD328F91AA92FD8FC82766DB3890A9
                                                                                                                            SHA-256:9AA0975F68F60A25E7082D0034B9B35285BA94B252D13DCF2FD819D754B79E95
                                                                                                                            SHA-512:1B0A36DBABD7BE6C247F40C34F65FBA0CDFC9CD8AE92191F69A6E896F88E7B0296781CC03F471598160A5EDD4696A487DEC7363DA9E3BC745EC5325EFDEFD351
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...............................J.o...S.....V.i...D.u.m...J.o.i...M.i.e...S...m...V.i.n...s.e.a.r.....s.e.a.r.a...n.o.a.p.t.e.......e...n.....T.r.i.m... .1...T.r.i.m... .2...T.r.i.m... .3...T.r.i.m... .4...n.o.a.p.t.e.a...t.r.i.m... .1...t.r.i.m... .2...t.r.i.m... .3...t.r.i.m... .4...d.i.m.i.n.e.a.......d.u.p...-.a.m.i.a.z.....T.r.i.m.e.s.t.r.u.l. .1...T.r.i.m.e.s.t.r.u.l. .2...T.r.i.m.e.s.t.r.u.l. .3...T.r.i.m.e.s.t.r.u.l. .4...t.r.i.m.e.s.t.r.u.l. .1...t.r.i.m.e.s.t.r.u.l. .2...t.r.i.m.e.s.t.r.u.l. .3...t.r.i.m.e.s.t.r.u.l. .4.......`5......./...mT.TG...>......TmT.T.......`5......./...mT.TG...>......TmT.T.............../.Z...P..._............./..=..d&(._...........Z..P......./.._.........0.8.@.H................... ...f.s.............!...................!.........&.............. ... ...........P;..P........H..PQ..P........... ... ..'.V...........Y...^...........c...h.............. ... ......".S...... ... ... ... ..`.... ..o.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ro_RO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rof_TZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ru_BY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ru_KG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rw_RW.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\saq_KE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sbp.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1916
                                                                                                                            Entropy (8bit):5.056398847671726
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:0ZdehNrA7Lr5mr81Va61/eBGeDrayBTSGUH+BV0Ui2K0:0ZdA27Zy61/9iayBTJUeB7i50
                                                                                                                            MD5:93947EAB0BFCDF0693987E9681499882
                                                                                                                            SHA1:FAE6A29211ECE1B3C79D9877D2676AE0A97B5C57
                                                                                                                            SHA-256:21E38B84AAC991D2CA14467962F5E861AE5DCCAF1CBEF4D251D0BE8525C7888A
                                                                                                                            SHA-512:1428F3F517A100CCCA1AD60B02A04239CA5C88EE8BDE6849B9E0D68B8D0EBA717A72EACC3F8C8CAE838A84EE5B94407B8E159CA4DAD4F7CCBE3ACB1D6F0F75C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .................................A.K...P.K...M.a.g...M.o.k...M.p.g...M.s.h...M.s.p...M.u.h...M.u.j...M.u.l...M.u.n...M.u.p...M.u.s...M.w.i...M.y.e...I.m.e.h.e...M.o.k.h.u...M.u.n.y.i...M.w.e.s.i...L.u.s.i.k.u...M.w.a.k.h.a...I.l.i.j.u.m.a...I.l.i.s.a.l.a...M.u.h.a.a.n.o...M.u.j.i.m.b.i...M.u.l.u.n.g.u...M.w.i.t.o.p.e...I.s.e.k.u.n.d.e...M.u.n.y.e.n.s.e...M.u.p.u.g.u.t.o...M.u.s.h.e.n.d.e...L.w.a.m.i.l.a.w.u...P.a.s.h.a.m.i.h.e...A.l.a.h.a.m.i.s.i...I.n.e.n.g.. u.n.i...M.u.s.h.i.p.e.p.o...P.a.m.u.l.a.a.w.u...[.q. .r. .x. .z.]...M.u.p.a.l.a.n.g.u.l.w.a...U.l.u.h.a.a.v.i. .l.w.a...M.u.s.o.n.g.a.n.d.e.m.b.w.e...M.u.s.h.e.n.d.e. .M.a.g.a.l.i...A.s.h.a.n.a.l.i. .u.K.i.l.i.s.i.t.o...U.l.u.h.a.a.v.i. .l.w.a. .l.i.s.a.a...U.l.u.s.i.k.u. .l.w.a. .L.i.j.u.m.a...P.a.m.w.a.n.d.i. .y.a. .K.i.l.i.s.t.o...U.l.u.h.a.a.v.i. .l.w.a. .l.u.s.i.k.u...-.[.A. .B. .C. .D. .E. .F. .G. .H. .I. .J. .K. .L. .M. .N. .O. .P. .S. .T. .U. .V. .W. .Y.]...-.[.a. .b. .c. .d. .e. .f. .

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\se_NO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2112
                                                                                                                            Entropy (8bit):5.138122058230904
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:Rrrmz7Nh9fnIeLgwQbuMCk4blFvHizLWr53dVa+:Az7D9fIe0wXlFvdrj4+
                                                                                                                            MD5:8BF7D34AFA0DA29A5569C59AFB4D79ED
                                                                                                                            SHA1:D49FE367C24FB92F3218664416D79202EF456A91
                                                                                                                            SHA-256:86924720A1FE45BD00C69D3039977D574CCBA4B41514A353C7A251FD0DA04CFF
                                                                                                                            SHA-512:0DC95D73E8D04C145FD7DA02B664005E65476ECB92A526ED683A743B0B96B583234C2925FD45FDC767F5CC7F824FDA469117A0048395328C965CF6BA649934D8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................................L.K...N.D...L.....B.k.1...B.k.2...B.k.3...B.k.4...B.k.5...B...l...F.u.l...F...n...K.a.k...K.n.K...K...k...L.e.n...L...p...L...y...M.b.....M.v.u...N.a.b...N.g.b...N.g.u...N.g.....N.p.K...N.y.e...N.z.e...B...r.....L...s.....B...k.u.a...F...n.d.o...M.v.u.k.a...N.a. .l.....B...l...w.....D.i.m...s.i...K...k...r.....L.e.n.g.u.a...L...p...s.....M.b...n.g.....N.g.u.b...e...N.y.e.n.y.e...K.a.k.a.u.k.a...L...y.e.n.g.a...N.g.b.o.n.g.a...[.c. .q. .x.]...K...k.e.r...k.e...K...o.t...n.g.o...N.g.b.e.r.e.r.e...B.i.k.u.a.-...k.o...B...k.u.a.-.o.k.....B...k.u.a.-.p.t.....B...k.u.a.-...s.e...F.u.l.u.n.d...g.i...N.a.b...n.d...r.u...B...k.u.a.-.u.s.......Z.u.k.a.n.g.b.o.n.g.a...F...n.g.b.i.s..... .o.t.....F...n.g.b.i.s..... ...k.o...F...n.g.b.i.s..... ...s.e...N.d.u.r... .n.g.b.o.n.g.a...N.z...n.a. .n.g.b.o.n.g.a...F...n.g.b.i.s..... .u.s.......K...z.o. .n.a. .K.r...s.t.u...N.a. .p.e.k... .t... .K.r...s.t.u.../.[.A. .B. .D. .E. .F. .G. .

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\shi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1552
                                                                                                                            Entropy (8bit):5.562679160282238
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:ta9q+l9FijMLmnaxXdvf6yojy11W25i6U2dMuVs0YJ+o1Es5vGBZmO3Juz26BV5a:ta9TlN1tvgwzigMEsMoEsoBPcPV5oV
                                                                                                                            MD5:369E29AED455406489C35EDD0EC292C0
                                                                                                                            SHA1:D235E1593F5ED711F521EB51F39A50D56B55B587
                                                                                                                            SHA-256:490B22DE9747E24E8484CE8365EF12D8ACFFEE0541074FEBA5A058180FF69633
                                                                                                                            SHA-512:B18525336F9A39215984395523DD904391584E3F3EA3B16414C9590EF0FA1AB95EC80F191968DA73644736079C488616F81DDC88E3603E0BAD7AC192BD3B9D64
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................o.. .5......|...|.........5.$........1-..7-..=-..V-..0-Y-I-..N-0-b-..0-b-O-..V-S-[-..0-=-U-..0-=-a-..0-Y-0-..1-U-0-..7-0-D-..7-<-D-..7-S-J-..=-\-S-..I-1-T-..I-O-O-..N-0-U-..O-S-a-..[-S-\-..b-S-M-..b-S-O-..0-Y-I-N-..0-=- .1...0-=- .2...0-=- .3...0-=- .4...0-Y-I-9-..0-Y-Y-0-..N-0-U-Z-..V-S-[-\-..0-=-U-0-Y-..0-=-a-0-Y-..0-Y-=-=-0-..0-b-O-0-Y-..0-b-b-S-T-..1-U-0-b-U-..=-\-S-1-T-..I-1-T-I-T-..I-9-M-M-I-..N-0-b-b-S-..\-0-Y-S-\-..b-S-O-b-S-..\-I-<-0-a-\-..0-Y-0-N-0-Y-..0-Y-I-O-0-Y-..I-O-O-0-b-T-..Y-I-N-a-0-Y-..\-0-Y-I-O-\-..b-S-M-b-S-c-..0-Y-3-3-o-0-Y-..0-Y-I-9-b-0-Y-..\-0-Y-T-0-3-\-..\-S-Y-7-I-7-\-..7-S-J-0-O-1-I-T-..O-S-a-0-O-1-I-T-..[-S-\-0-O-1-I-T-.......C......NN....k..)...4mhEy.C............................W.!.0.............'./..4K,c.\.C..4.4.4....].N.'..P/..N..................k..)...4.MW*.).4......................0............\.....\.\.\.\.\...\..................W.!.0.............'./..4K,c.\.C..4.4.4....].N.'..P/..N......V.F.>.N.R...............8...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\shi_MA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.8246240823663435
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlgelU8gl8l/66NPDelOpWn:SBtkJZlU8g8l/3YleW
                                                                                                                            MD5:BF9476BA2EE2652492A3C93F90DBD11F
                                                                                                                            SHA1:3A739DF1E67CA5ED347E751208765B2ED7226358
                                                                                                                            SHA-256:5FED9386CED762843B518BC2C859E899C4B1616D7B6A1B29F86CEF89B7D2A74E
                                                                                                                            SHA-512:B37937F77CEA2378AB23CD3435DFFF96C7C271E8EBD4C0ADE3272BAAC1D52B0119E26FCCF762354587D3F00E2FABD51D6D5A4C2D785BAFF00D6A4A5B7744F4F8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.................................s.h.i._.T.f.n.g._.M.A.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sk.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20592
                                                                                                                            Entropy (8bit):5.567056141429851
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0/V5/luxv6JBmatRuaM+rrqcccoDT5UfUP72zMt2UOVjgC:yD/Eh6JB++rrnMFOKC
                                                                                                                            MD5:839D5BDEEAAED1C24E312907C4F4F3C7
                                                                                                                            SHA1:9E9568CB145D194A27B06B9C5BFD6F63FBD6BDD2
                                                                                                                            SHA-256:F130D2930495255A2A439EA770F259DA24E8E7F0CE0763B46833F988A23385C4
                                                                                                                            SHA-512:A6D4A0A5D8C90DBA16B0F264ABB02512986886BCB089641658D8F1B9E0B2E28C573045129BC6799B424C2D4ECF55B82C7A9B36DC4BD351B40AE9ABA6CFC9C652
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................V................d.e.i...t...r...j...l...j...n...m...j...a.a.....m.u.~...r...n.o...p.a.u.a...i.j.a.r...m...g.h.....b...n.....z.a.r...d.n.e.s...`.a.k.a...r.a.d.....a.a.u.....j...l.a...j...n.a...m...j.a...n.a.p.....v. .n.....~.e.n.a...h.i.d.a.r.....a...d.h...a.e.v.a.t...v...e.r.a...h.a.n...a...m.a.r.c.a...m.a.r.e.c...r...z.n.e...s.r.d.c.e...t.e.r.a.z.......s.l.a...a.p.o.r.t...a...p.k.y...g.i.n.b.o.t...k...r.t.i.k...m.i.y.a.z.a...m.o.r.d...d...p.a.g.u.m.e.....a.i.t.r.a...p.o.p.o.l.....p.o.l.n.o.c...d.e.H. .r.....d.o.p.o.l.....l.e.t.o.p.....n.e.d.e.>.a...r.a.d.~.a.b...s.t.r.e.d.a...v. .n.o.c.i...a.a.u.v...l...a.p.r...l.a...b.u.d.o.v.a...f.o.r.m...t...h.o.d.i.n.a...j.a.n.u...r...k.l...v.e.s...m.i.e.s.t.o...m.i.n...t.a...n.a.p.o.l.....p...r.o.v.....t.e.l.e.s.o...v.l.a.j.k.y...z.v.i.e.r.a.....l.o.v.e.k...o. .{.0.}. .h...o. .{.0.}. .s...b.a.. o.u.n.a...c.h.e.a.v.a.n...c.h.o.r.d...d...d.~.j...a.t.h...p.h...l.g.u.n...t.i.k.e.m.e.t...v.a.i.a...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sk_SK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sl_SI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\smn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4992
                                                                                                                            Entropy (8bit):5.3077770645051645
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:d3j4DdFqHMQryhp7DpRtHutN/bUl9JFZ0HLCdIsjIvNsNKkmG:d3+f717HKN/bUnJF3dI0SoLB
                                                                                                                            MD5:9915786772AE79B55A58EDA6004DBF83
                                                                                                                            SHA1:122F2C481E87852FB0AF2D87B81A5BB5FD6016C1
                                                                                                                            SHA-256:30AB12B4710F7AB7B7FFB3D0D4389B953078F2A6BCDB1758C5C8DFFEE8BC90DF
                                                                                                                            SHA-512:6E1C7EFA33D81D9861D0D6F4990493D0E9A50AB88E9342F2FAA3CC891F75A5159A2FECA54D938AEB8F6691994C0764D565E8CBA3DEE777759047375E112D332A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................)................l.....p.a...v.u...v.....i.p.....k.o.s...l...v...p.a.s...t.u.o...v.u.o...v...s...L...y...k.e.s.i...u...i.v...m.K.r.....m.........o.K.r.....o.........k.u.o.v.....p.o.r.g.e...v.y.e.s.i.....o.h.......L...y. .G...m...s.s.....c.u...K.u.i...j.u.o.v.l.....n.j.u.h.......s.k.a.m.m.....s.y.e.i.n.i...r.o.o.v.v...d...e.p.i.l.o.h.o...k.o.s.k.o.h.o...k.o.s.k.o.k.k.o...l...v.u.r.d.u.v...l...v.u.r.d...h...m.e.t.r.i.s...a...1... .n.i...l.j.....2... .n.i...l.j.....3... .n.i...l.j.....4... .n.i...l.j.....k.e.s.i.m.....n.u...E.,. .M.M.M. .d.....a.m.e.r.i.k.l...a...b.r.i.t.t.i.l...a...m.a.j.e.b.a.r.g.....p.a.s.e.p.e.i.v.i...t.u.o.r...s.t.u.v...t.u.o.r...s.t...h...v.u.o.s.s.a.r.g.....k.u.o.v...m.....n.u...p.o.r.g.e.m.....n.u...v.y.e.s.i.m.....n.u.....o.h.....m.....n.u...c.c.c. .M.M.M. .d.....d... .. .d...M...y...m.a.j.e.b.a.a.r.g.....p.a.s.e.p.e.e.i.v.i...v.u.o.s.s.a.a.r.g.....0.0.0. .b.i.l.j.o.v.n...0.0.0. .m.i.l.j.o.v.n...0.0.0. .t.u.h.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\so_KE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):132
                                                                                                                            Entropy (8bit):3.92328511820183
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tl0qUmlvlllK6gOZMH292ni2Pc3nslulflFpLbN:SvEqtPCJOyW92ni2Pc3nVTFX
                                                                                                                            MD5:05AAE6AD646FC609E972F1AC310EB11F
                                                                                                                            SHA1:FDD4C78C7A9EF570E3F328A37FA38B73BD518065
                                                                                                                            SHA-256:02D8BE65FF5BD34FA9DF351C4F32F958C16EE1BA4D082B99AAF20795BAC10E4F
                                                                                                                            SHA-512:F0A24C8E0256284F6B3C5C6BC065A801BCD2132E40168A5229DFE30C8CBDAA440E2E449D6080110EFA1FF283EEF05289D967FF074E29B00572E9271243FF372B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .l....................l............k..)...4.|.yn.8.......................`.... ..o.w......`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\so_SO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sr_Cyrl_ME.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):524
                                                                                                                            Entropy (8bit):5.2552622387790615
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:3zAT6qiv6LdAuAzTE7WYsXWWYsTyyWqSIvxA1h2t2TqW64a:jAT86LdBVWY7WYaLi1hULWu
                                                                                                                            MD5:D989D18C09E8FE8402CE1B8421486ACE
                                                                                                                            SHA1:CCA30A2644CFB352E452AB76DC6FEB47B3873403
                                                                                                                            SHA-256:381B5C5ABE5FC34C609ACD7A5BD124E8A975D18BCA58306C3873D8540C50ED91
                                                                                                                            SHA-512:1D8775D32594E928702723363BA4BBABE76C0AA9B74010F8CE246E4F50DC7006121506E3C2340B43B4C299FBF857CF42D90C9623401DC1E07964D96EBC755061
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................w.. ........{...{...........A............$.5.5....A6....A6.......J.............J.........j..;.....,...^..j..;.....,...^............/.z.<.5.g................./.z.<.5.g.7..........A6.......l&.........A6...3`9`..!.e.......e.`........`a...!.e.......e.`........`a........P..5.A.. ...........P...P............"...........I.. K.. ........*..P7..P........D..PI..PN..P........Q.. U.. ....S.......V.......c...........`.. b.. ..j.v.......".H.........E.. M.. Z.. ^.. d.. ....`...C.. h.. ..o.w......`s..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sr_Latn_ME.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):588
                                                                                                                            Entropy (8bit):5.505236769719622
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:sQWyu11b9J39VX39SA1dALRs/m++e/lxW4t2Pa1:sHy6hD9F9SYGtqSa1
                                                                                                                            MD5:BC70D18A9840F784A59545073343CBA0
                                                                                                                            SHA1:784143D29C0136CD09E75371EF8D06664844BD32
                                                                                                                            SHA-256:C444F5069E2186A1BE726A493B3D207A8AC62FA1FC1EFA6A6DD1DF56C87B6836
                                                                                                                            SHA-512:9C3905D4F9BC773DF5AB2E3002DDFF019374DB39941CC35BED431A0DC285465D1B4F1A3EBFF77B131011B9777E9B840C58563E90C56CFED7EDEEFCC57B2DF2B8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................M........s.r.....u.t.........$.5.5...t?....t?........J...........J.........cBrG...M.MyT..b. .5|].u..n.g..cBrG...M.MyT..b. .5|].u..n.g............/...0...%.<.l............./...0...%...l.......t?........l&........t?.....^.^....z.L....z46..Y.{C..........z.L....z46..Y.{C.............P..5.M.. ...........P...P........"...*...........2...:...........U.. Y.. ........B..PO..P........\..Pa..Pf..P........a.. e.. ....k.......n.......{...........p.. r.. ..j.v.......".H.........Q.. ].. j.. n.. t.. ....`...O.. x.. ..o.w......`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sr_ME.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.870450165586334
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/66XglLMA+973:SBtkJYlU8g8l/3wJAt
                                                                                                                            MD5:DE637ACC0444DFF5B10B24757FD5D01A
                                                                                                                            SHA1:66D26A6934A109E7A74C26A9E5EB2877F0898DB5
                                                                                                                            SHA-256:3BDE340A4FA05DDC957B603CEE413A59B4A3A4955D981CDA2AC34D4FA4DE8A6E
                                                                                                                            SHA-512:88765889E5297825F3D0F7576E838D95F4AE9651D079AB3719A36D234FC91D6F18A84FB92522D18EA059A3CFF7672BF746D7352A81DA94A42C8308175DC8DDD1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.................................s.r._.L.a.t.n._.M.E...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sv_AX.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ta.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20648
                                                                                                                            Entropy (8bit):5.629431761876921
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:vf//o2NVm1fy4j6S/KCbbfCg6vu6GcxPJRGMP6lBL+2yrwa/k+ad6N28cu3bsrJl:/bNVm1fy4j6S/KCbbfCg6vu6GcxPJRGR
                                                                                                                            MD5:8A569834D57201D193F06C17936B9999
                                                                                                                            SHA1:A45223738B57704B080100A407810465FF780274
                                                                                                                            SHA-256:B09BA04CDF3E300380846E48882D78AD9B070E85B4D5879A1FDB753240136D0B
                                                                                                                            SHA-512:78CB8942F0D8AA7255620B574DBA8ECC7238BB597E50A92DB95220D506B64B454CFA636427203F05819CB771AECFD84E765CD519E4982657B642C6F60B7A8BD5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........"..."...V.......5........................................................................................................................................................................................1.......2.......3.......4.......5.......6.......7.......8.......9.......................................................0.......................................................................................0...........................................................................................................................................................................................................................................................................................................................................1.0.......1.1.......1.2.........................................................................t.a.m.l........................................................................................... .1......... .2.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ta_MY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):116
                                                                                                                            Entropy (8bit):3.6003005537073154
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlEF1qbl7MPqM3kglFsvMKbWcf:Sv81qSSMncMK
                                                                                                                            MD5:CF910C94198F1D415E241CB7644A9830
                                                                                                                            SHA1:5BBCD10A7F464A5E5ECC47F94DE71EB3A4844D3D
                                                                                                                            SHA-256:CB701F199A91520E73B21A7674402446A7E6A5F462D30ED088F40365BCB1A4DA
                                                                                                                            SHA-512:331B0451F7DD00BCD4A861738216B0AF7D0E45B101039A9FB2368669B5E5A74D987C6E97BD2C9513A5C54FB8E57953D5BD1D89ADE1638E5B583AF87C0E66778E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..B....................B.............7...Y4.B.........P....... ....o...... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ta_SG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):116
                                                                                                                            Entropy (8bit):3.6003005537073154
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlEF1qbl7MPqM3kglFsvMKbWcf:Sv81qSSMncMK
                                                                                                                            MD5:CF910C94198F1D415E241CB7644A9830
                                                                                                                            SHA1:5BBCD10A7F464A5E5ECC47F94DE71EB3A4844D3D
                                                                                                                            SHA-256:CB701F199A91520E73B21A7674402446A7E6A5F462D30ED088F40365BCB1A4DA
                                                                                                                            SHA-512:331B0451F7DD00BCD4A861738216B0AF7D0E45B101039A9FB2368669B5E5A74D987C6E97BD2C9513A5C54FB8E57953D5BD1D89ADE1638E5B583AF87C0E66778E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..B....................B.............7...Y4.B.........P....... ....o...... ...`

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\te.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):19020
                                                                                                                            Entropy (8bit):5.652113221179184
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:5JgVYyOgOeq60sK9d2T9PHIKx+mnMvWxrkm9r//4033N9ZVJqWnnn8jOa9YYtJzN:f3yOgO1sKHsLxH9TA033jMYYtJzfbKm
                                                                                                                            MD5:030F7037F860C1347398686C0AE1D2A6
                                                                                                                            SHA1:88280661BC0BE66A3F7F3D50A713D2F52F89D884
                                                                                                                            SHA-256:F89258A352C8CCA1B78027B969DFC693C9229D5FD899276281BA0FB510A931C4
                                                                                                                            SHA-512:A1329A0E048CF6555F183B29D2228E7E50F50CD3D2207A6CD1972923D55447DCCEBD92B38CBAF26F35C3AEC0B552548FCE30471850045F64FD33F898B81AA3F2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................r.. ................V.....................................G.....5...!.G...6.............A.....(.....B...+.?...,.A...........>...5.>...6.A...8.K...8.>...8.K.....6.(.?.....&.?...,.A.'...(.5.....0.......8.......8.+...............&./.....8.F.(.F.......0.M.....&.0.M.....,.(.M...../.0.M.....A.0.A.....A.2.H.....B.(.M.....?.0.M.....L...M...$.K.,.>...(.H.8.G...*...(.>...,.>.,.>.....>.........0.,.?.....0...?.....0.5.G.../.A.......0.G.*.A.........3.....A.9.....0... .I...7.,.>.....8.F.......t.e.l.u.........F.....$.0.....-.5.(.......9.?.3.../.A...F...0...,.M...8.+.0.M...9.>...0.M.....7.>.".......*.F.*.M.....2.A.2.M.....?.9...M...$...A...M.....F.9.0.M...6.A...M.0...9...M.2.F...9.F.&.0.M.....0.0.,.?.....0.0...?.....0.0.5.G.....J.(.M.(..... .(.F.2...(.?.(.M.(.......M...K.....*.M.0.?.....(.5.0.?...!.?.8.F.....$.M.0.H.....$.M.0.H.1...$.M.0.H.2...$.M.0.H.3...$.M.0.H.4...+.?.,.M.0...0... .I.I...0.....>....... ...........M.0.@.6.......$.0.........C.$.?.......K...?.....>...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\teo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1832
                                                                                                                            Entropy (8bit):5.124424743232553
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:kji72PUoUuEt+VW4GD9yjrqmJlPNjMVrjMFWC4Zbe8NKm6EorV:Wi72P4Dz9yjrqqPFMmB8NLwrV
                                                                                                                            MD5:83BE3546B7B6922953E90D9726486719
                                                                                                                            SHA1:758394823919004EB8AC4DF221A3714FA6891323
                                                                                                                            SHA-256:3E3D6A9E34AFECEFF81EF394A00791B1331378CBC2F510C1A63235F374EFBBE7
                                                                                                                            SHA-512:7FEA8D4613E56CBB2CF395D46DC55AA85D9E6F9DDC2C7937EDE5B75C7FFEA7665E0CA4ED85967E2B970A5D400AF9F93B35C6A76A77FE5430D82A5164AF2630D7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................j........A.a.r...B.a.r...D.u.n...J.o.l...K.w.a...L.a.b...M.o.d...M.o.i...M.u.k...P.e.d...P.o.o...R.a.r...S.o.k...T.i.b...U.n.g...U.n.i...E.k.a.n...E.l.a.p...E.n.z.i...E.s.a.a...J.a.a.n...L.o.l.o...O.m.u.k...O.p.o.o...E.w.i.k.i...O.j.o.l.a...O.r.a.r.a...T.A./.E.B...E.b.o.n.g.i...A.p.a.r.a.n...O.l.a.b.o.r...O.m.a.r.u.k...O.p.e.d.e.l...O.t.i.b.a.r...N.a.k.a.a.r.e...N.a.k.a.u.n.i...O.k.w.a.m.g.. ..[.f. .q. .z.]...I.s.e.k.o.n.d.e...N.a.k.a.k.a.n.y...O.d.u.n.g.. e.l...T.a.p.a.r.a.c.h.u...N.a.k.a.e.j.u.m.a...A.k.w.o.t.a. .a.b.e...N.a.k.a.s.a.b.i.t.i...N.a.k.a.u.n.g.. o.n...A.k.w.o.t.a. .A.a.n.e...A.k.w.o.t.a. .a.u.n.i...N.a.k.a.e.b.a.r.a.s.a...O.s.o.k.o.s.o.k.o.m.a...A.k.w.o.t.a. .A.u.n.g.. o.n...O.m.o.d.o.k.. k.i.n.g.. o.l.../.[.A. .B. .C. .D. .E. .G. .H. .I. .J. .K. .L. .M. .N. .O. .P. .R. .S. .T. .U. .V. .W. .X. .Y.].../.[.a. .b. .c. .d. .e. .g. .h. .i. .j. .k. .l. .m. .n. .o. .p. .r. .s. .t. .u. .v. .w. .x. .y.]...........)..k.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\th_TH_TRADITIONAL.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):2.935700764148065
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtldelFal9lzs9dwj/awPkaV:SBtkJUlYgQBkc
                                                                                                                            MD5:BD3F2E18B27EFB04FD9CBEE94DEA3189
                                                                                                                            SHA1:36710D9106EF3A860AEA28C12D206EEF478050FF
                                                                                                                            SHA-256:10B7EF58A9B44409AD9138088424A0501C2A37F7B8C5444DF04772901B05EC3D
                                                                                                                            SHA-512:F2D14C41E5B64064C2A36BB03E49B433B0E85DF7BA0A4DD7D7A39BEEA54330A77F4ADDF72038F57B93AB78181B71AC9BEE214AC8E1AA858B557282795508B865
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .................................b.u.d.d.h.i.s.t.....t.......w....P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ti_ET.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\timezoneTypes.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20052
                                                                                                                            Entropy (8bit):5.040657283644707
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:wE3xOg0ZgZ4x5TBmZOP+/kFK58jf/iQcsUmpq86yYBZkosAn3/OPt4tk:wE3xvQgm5TBZPtFK58j3iQclmg9yYBCj
                                                                                                                            MD5:2812397EB44D2339F89F597975AD7EDB
                                                                                                                            SHA1:8CC44BB6C7B0EC4036015E39E56A4A157CC21063
                                                                                                                            SHA-256:6647C6B9901E8A621B8A1A0E7CACB20B30A1200D84C8F5028B2FDC56C9996F6D
                                                                                                                            SHA-512:B71DB9CD26C1BDF6EB0484E7A0D62CA10CF673E4D8C99FF4EDEC4B5D8360BA33707FA2264854EF1E4C1D3AFA0E4064EEAB9004A720E458D31E91D2E978978088
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................bcpTypeAlias.tz.aqams.cnckg.cnhrb.cnkhg.usnavajo.typeAlias.timezone.Africa:Asmara.Africa:Timbuktu.America:Argentina:Buenos_Aires.America:Argentina:Catamarca.America:Argentina:ComodRivadavia.America:Argentina:Cordoba.America:Argentina:Jujuy.America:Argentina:Mendoza.America:Atikokan.America:Atka.America:Ensenada.America:Fort_Wayne.America:Indiana:Indianapolis.America:Kentucky:Louisville.America:Knox_IN.America:Porto_Acre.America:Rosario.America:Shiprock.America:Virgin.Antarctica:South_Pole.Asia:Ashkhabad.Asia:Chongqing.Asia:Chungking.Asia:Dacca.Asia:Harbin.Asia:Ho_Chi_Minh.Asia:Istanbul.Asia:Kashgar.Asia:Kathmandu.Asia:Kolkata.Asia:Macao.Asia:Tel_Aviv.Asia:Thimbu.Asia:Ujung_Pandang.Asia:Ulan_Bator.Asia:Yangon.Atlantic:Faroe.Atlantic:Jan_Mayen.Australia:ACT.Australia:Canberra.Australia:LHI.Australia:NSW.Australia:North.Australia:Queensland.Australia:South.Australia:Tasmania.Australia:Victoria.Australia:West.Australia:Yancowi

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\tk.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14848
                                                                                                                            Entropy (8bit):5.437589029987393
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:F8S4sPb63nKWkUqqpe5+lfzgdPY0J2Yj+zhz9Pjlg+UkfO8+rCvb/JOafvvMw0tS:h4sPuFC6r9kTJ2Yj+zyNkAuz/rwDw
                                                                                                                            MD5:5EF76781775A06F24A210157FB54FD2A
                                                                                                                            SHA1:380EF9F25581CF1E5E151217A5BA062E0D38C11C
                                                                                                                            SHA-256:6FF666BBAAB5ADCAE0603940B20257F469E9A99D0251BF27943C9EB0282C1A09
                                                                                                                            SHA-512:7B1695DB6C60881450804310111FF2E94D36DBA5F72D6129DAB839A3631B6534EE15044836ED2D1CED5EDFB7F2F841A7AA63C51C3606124D1D0990BFEE086EEB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................^.. ........x...x...V....................4.....1.....2.....3...........A.n...D.b...P.b...S.b.....b.....b...^.b...m.a.....A.B.^...M.a.....A.n.n...A.w.g...D.e.k...D.u._...F.e.w...N.o.....P.e.n...S.i._...a.n.n...a.w.g...d.u._...f.e.w...n.o.....p.e.n...s.i._.....a.r.....a.n.....e.k.....a.r.....a.n...^.e.n..._.e.n...I...u.l...I...u.n...h.e.p.....i...u.l...i...u.n...s.a.g.........r.....A.n.n.a...B...e.....b...e.....d.....n...g.....H...h.o.w.a..._.a.h.s...G.../.G.S...g.o.....H..._.u. .d.b..._.u. .p.b..._.u. .s.b..._.u. ...b..._.u. ...b..._.u. ._.b...B.r.a...l...b.a._.g.a...d.y.n.g.y...d...r.l.i...e.r.k.e.k...e.r.t.i.r...g...s.o.H...g...w.r.e...h...z.i.r...z.e.n.a.n.......r.e.k...^.e.n.b.e..._.u. .a.n..._.u. .a.....g.o...s.o.H..._.u. ...y.l...A.w.g.u.s.t...B...e.....H...F.e.w.r.a.l...N.o...a.b.r...b...e.....H...b.a...d.a.k...f.e.w.r.a.l...h.a...w.a.n...k.a.n.d.z.i...n.o...a.b.r...o.b...e.k.t...s.a.n.l.a.r...s.e.k.u.n.t.....a.n.w.a.r.....a.n.w.a.r..._.u. .a.n...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\tk_TM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\tl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):84
                                                                                                                            Entropy (8bit):2.5687727460466143
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlw10lgylslplglzstPRAen:SBtkJQ0ltWpglI1
                                                                                                                            MD5:DCCA8D89C11300C1AD5DC8B9DBF2E0EA
                                                                                                                            SHA1:6D3661C44EE2A839AC14594D496A159153098F93
                                                                                                                            SHA-256:B99B6B16340A21C13EA42CCAC8A1CBFD6A8704CB403EB3DAD80DD1909832DDA6
                                                                                                                            SHA-512:5EEC5AB96057FB76CF86974AF05D3CE63088D4ACB998B237B7D499E8EAAA1E12CE296302D04F0D67788D8FEF5F10863BBEF4806F29D9A4A2987E3344279D5E80
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.................................f.i.l.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\to_TO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\tr.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):16304
                                                                                                                            Entropy (8bit):5.59428953383426
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:gJ/vHvyv/3UwC/Hh/x77j4nFFyNJr3qUyqJjy0ghX/gvGlynwwXvsHjyNcC946/F:g6XUw0/siwUyqJW0agvBnwwG+mw
                                                                                                                            MD5:D898E7A4C45E2305CFF411791C5CABBB
                                                                                                                            SHA1:58600E3EE23ED5DAD881881A85B6590D1C8316CF
                                                                                                                            SHA-256:EF7950C979256FC6A537F82523C85AC0A29A72B42C809A5FAC3DC9192855DDF1
                                                                                                                            SHA-512:703C8FD32DF60B6BC8B74AD29D043E37606CDEEF23C0631906D28188F267EFEF6C800909F90794379F8F3A9D0ED3EC948FD8694448BA555CD2D2D508229C8CFB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................V....................^.........C.t...C.u...P.a...P.e...P.t.....1.....2.....3.....4.....a.........M.S...M.......s...0.....T...t...d...n.....a.....A.r.a...A...u...C.m.t...C.u.m...E.k.i...E.y.l...H.a.z...K.a.s...N.i.s...O.c.a...P.a.z...P.e.r...P.z.t...S.a.l...T.e.m...d.k.....h.f.....s.a.....s.n.......a.r...^.u.b...t.u._...g.e.c.e.......l.e...B.u.n.e...B...b.e...E.b.i.p...N.e.s.....T...b.e...0.y.a.r...C.u.m.a...E.k.i.m...O.c.a.k...S.a.l.1.....y.r.....A.z.e.r...e._.l.i...k.a.l.p...s.p.o.r...a.k._.a.m...s.a.b.a.h......./...S...b.u.g...n...I.m._.i.r...M.1.s.r.....R.e.c.e.p...S.a.f.e.r...T.i._.r.i...^.a.b.a.n...^.e.v.a.t...H.i.c.r.i...b.u. .a.y...y.a.r.1.n...E.y.l...l...H.i.d.a.r...K.a.s.1.m...M.a.y.1.s...P.a.z.a.r...d.i.l.i.m...^.u.b.a.t...b.e.d.e.n...b.i.t.k.i...b.i...i.m...d.i...e.r...e.r.k.e.k...k.a.d.1.n...n.e.s.n.e...r.a.k.a.m..._.i.m.d.i...0.0.0...M.n...0.0.0...M.r...0.0.0...T.n...b.u. .y.1.l...H.e._.v.a.n...K.e.y.h.e.k...V.e.a.d.a.r.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\translit\en.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):320
                                                                                                                            Entropy (8bit):3.9067583285500707
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SBtkJOtoKRBKXC+mpRIzARhHf0jRhH7PaFYl6laz1E3GmglSUjrNDUN8Al:WZtnnMtmp/D0jnP1klaz1iGWr80
                                                                                                                            MD5:B567B384A3F3EAA1CE37047152D3B7B3
                                                                                                                            SHA1:6BE9731C3791AA0B1B8F4C2AD306AABF7C6C0DE4
                                                                                                                            SHA-256:7CD2B3630AF371A8BC5ADBA3269E48F4BE1FF9566AD000B04D5E9229D0C6761E
                                                                                                                            SHA-512:46E68087935D0EBC5DBE0D2B1EA0DF3BB8E58D57827DDA6640EC1E27BA7AEF05B6523885E6D94354B3FF008FD0EEE132305E41630AF7B4F35CFA6F7C10E949BE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................L..P........H...H...........H...TransliteratorNamePattern.%Translit%Hex.%Translit%UnicodeName.%Translit%UnicodeChar...H.e.x. .E.s.c.a.p.e...U.n.i.c.o.d.e. .N.a.m.e...U.n.i.c.o.d.e. .C.h.a.r.a.c.t.e.r...{.0.,.c.h.o.i.c.e.,.0.#.|.1.#.{.1.}.|.2.#.{.1.}. .t.o. .{.2.}.}.....:.^.H. .......+...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ug.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):7836
                                                                                                                            Entropy (8bit):5.638847482730833
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:SNc9y7wRGv2s3tLrZsRrm1rEDwmIy4+657stvMgCq+bKD11mwyppGcgH4wb0bGAo:2y4V57stEhq911mw2GcTkv
                                                                                                                            MD5:3D4CEC32C7E2A3E04885FDB27986578B
                                                                                                                            SHA1:A684187A82895BFC7EB0934F40C2FEF6D025FA68
                                                                                                                            SHA-256:7AEFB450AD768C6AC410BAD64FF28BBC8448E66E6CA08688F48D9770672180D9
                                                                                                                            SHA-512:FFAA2CFE560D4B034AA9AA7B7DB3B8009ADFF72863F83A0CA73918A125EA85F6DEB176F37D5D385068A8618DAE5FD292E7436452F18D9BCDDA619EAC91BC7320
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................)................~...,...../.....3.....4.....~.......'.......(.......C...B.H.J...M.o.1...M.o.2...M.o.3...M.o.4...M.o.5...M.o.6...M.o.7...M.o.8...M.o.9...&.'.*...&.I.*...C...F...d./.. M...&...*.....*.H.......C.'.D.'...&.I.J...D...&.I.J...F...1...,...(...3...~...1...E.I.F...H...y.-.d.-.M...(.......F...E.I.F...*...E...*.I.1...J.I.D.'.F.....H.4.B.'...0.0.0.E.I.....&.'.~.1...D...A.....1.'.D...J.'.F...'.1...4...&.(.'.F...4.......'.D...(... .&.'.J...(... .J.I.D...M.o.n.t.h.1...M.o.n.t.h.2...M.o.n.t.h.3...M.o.n.t.h.4...M.o.n.t.h.5...M.o.n.t.h.6...M.o.n.t.h.7...M.o.n.t.h.8...M.o.n.t.h.9...[.. . .&.]...*.H.4.B.'.F...3...C...F.*...E.'.J.E...F.....'.4.B.'.F...0.0.0. .E.I.....&.'...:...3.*.../...C.'.(.I.1...F.H.J.'.(.I.1...(... .,...E.....1.-.~...3.I.D...2.-.~...3.I.D...3.-.~...3.I.D...4.-.~...3.I.D...1.'.E.I.2.'.F.....I.,.1.I.J.....M.o.n.t.h.1.0...M.o.n.t.h.1.1...M.o.n.t.h.1.2...y. .M.M.M. .G...y. .d.-.M.M.M...&...,./.I...'...*...F.......F...{.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ug_CN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\ar_SA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/FMlln:SBtkJ1li6gml/K/n
                                                                                                                            MD5:C34486D88A5544F3392A4FB031ECA28C
                                                                                                                            SHA1:287AE38B9011FD9BF97FAC414B405F1748B748FB
                                                                                                                            SHA-256:F7835F43B81AF073E115DCDBDD71E6D274C476853FFE6BEFCFF4A6DD26E02CC6
                                                                                                                            SHA-512:DD334E26082CD5F5B9CF2DD581930DB2DCFC8AE136FEA02B0A7E8376BAA2C0582236086C7D973A84C14EB3F873C6F540E70FE65917D757C6FA630E56CD780C35
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\ars.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.7376269297851303
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlKelBjlgljl/Fi6l2lkWa:SBtkJTl4m6s+Wa
                                                                                                                            MD5:8ED16C31FC6340DF909D01B9C16F4F94
                                                                                                                            SHA1:8EC9A4CAC56FFFF46F6206D83AC9A47EBB74D19A
                                                                                                                            SHA-256:99DBE615C6B418ABAC0EBFA6446AFEA74887CA6D7E980D5D37951E136812B615
                                                                                                                            SHA-512:74DBEE84D173A931310EE3883581436C4A7D8F722FF3F88E6FCDEEFA56D36DE0C3BB5D5C6FC933655687911084FA4962568CAAE84F8466B72102AFB8191BE637
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci..a.r._.S.A.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\asa.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\az_Cyrl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):2.9794524468707886
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/flflcUTNZlgY/:SvV/cMEY/
                                                                                                                            MD5:6A9273AF56E5D1F6F2D24203334DDF9B
                                                                                                                            SHA1:BD7CA1CB1BA90B6036803043B8E351E6EC499DA5
                                                                                                                            SHA-256:F1D94FCB430E36370FA030C9D9892214DCB624289BC5282D432BF2A49378A08C
                                                                                                                            SHA-512:066CC289321C632CA0657AAC15F9F0E121C506B3EBD752E19277A5087417430E3C40525E0B410B930EF3A238328906AA64BF2A53B0FEBB26724918333C500508
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci..........g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\bas.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\bm.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\bn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14140
                                                                                                                            Entropy (8bit):5.520887247421295
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:h5JxPZT5Q1Lcd052yMu/o3k5EBjW2QZ3bevHZODEaJi7CvG8empbN:zHQg07/cNW1ieiGvG8empp
                                                                                                                            MD5:5BFE2FF4E8FEE4AE11BCD015066B4A6D
                                                                                                                            SHA1:B3D468624152331D1C6E57FA506C89F39507C351
                                                                                                                            SHA-256:CFC47816762D32DBE6345585028F0B790C9E1748081A960C8D3AB8FF7EC42081
                                                                                                                            SHA-512:90E3BA5C492DBAECA33DB751A5B8A3021853899D0C27B93060EC9A74BD74A42803239BDCF2DCEAD0B93AC775AA9F9736823070425187A57BEDA8B1CF3487C549
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .'....................'.....91ci..p.t.s...{.0.}.....{.0.}.....{.0.}.....{.0.}.......{.0.}. .....{.0.}. .....{.0.}. .....{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}./...:...{.0.}./.........../.........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}./.........{.0.}./.........{.0.}./.........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}./.....:...{.0.}./.....:......... ................./...:...{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}.............{.0.}.............{.0.}./...........{.0.}./...........{.0.}./...........{.0.}.............{.0.}. .............{.0.}...............{.0.}. .............{.0.}. .............{.0.}. .............{.0.}./.............{.0.}. .............{.0.}. .............{.0.}. .........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\ceb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.368272640304357
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQvlU8WNlUUT+l2iAllfPl6vn:SvIC8wNCl2iA/lan
                                                                                                                            MD5:4DF34AF3EA33B8989DDA28796A2F88A5
                                                                                                                            SHA1:7D688E8CB94E79D75E9AB3AC6A0F11B0A2BEB468
                                                                                                                            SHA-256:955F10221EA49D76E8996338EFB1834F7A0F8B825111159C90FE74C3104DF464
                                                                                                                            SHA-512:1E6354D1C1533421306045B12C2A284F99F4336E0078EBAF2AE7BB2A80BE7B3AE0876DAB4656C4DA10252C25CC4C7273E305CE93C3457CF6082F49FE3A66D903
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .H!...................H!....91ci..........!.............G!.`...P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\da.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):11476
                                                                                                                            Entropy (8bit):5.433357975981125
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:ODJyuxj1Lik/WIarEU2CEFs7z/GHCe4fE6CeIS:Oz8k/WIarEUMuPGqs6Cel
                                                                                                                            MD5:8D16BF2551834657F60AE1CD1B789F9D
                                                                                                                            SHA1:3543C08108FD00F28D81360BA53F87014CAAC25C
                                                                                                                            SHA-256:FDA6E27F5BADBEA433D99DD75427372AE13A4EFA750EBCC4C97A651A49385705
                                                                                                                            SHA-512:C025F7C6F5F172AB6401FC583F3759C1E5367C23C128652FCD63CBA5279E97DEB25DC070BB3E7EBF40468226A31004A114AEF4CCC8AB4AAFAEDFB2441C77F5B3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................%.. ........-...-...............91ci..{.0.}.....{.0.}...m...{.0.}. .a.e...{.0.}. ./.t...{.0.}. .f.o.d...{.0.}. .k.t.....{.0.}. .u.g.e...{.0.}./.d.a.g...{.0.}./.u.g.e...b.u.e.m.i.n.....b.u.e.s.e.k.....{.0.}. .s.y.d...{.0.}. .t.d.....{.0.}. ...s.t...{.0.}. .k.n.o.b...{.0.}. .#. .H.g...{.0.}. .d.a.g.e...{.0.}. .u.g.e.r...{.0.}. .p.k.t.....{.0.}. .p.c.t.....{.0.}. .t.s.k.....{.0.}. .c.u.p.s...{.0.}. .m.d.r.....{.0.}. .t.d.r.....{.0.}. .v.e.s.t...{.0.}. .s...m.i.l...{.0.}. .s.p.s.k.....{.0.}. .k.m./.t.....{.0.}. .t...n.d.e...{.0.}. .t.e.s.k.e...{.0.}.s.v... .m.i.l...{.0.}. .t...n.d.e.r...{.0.}. .p.r... .k.g...{.0.}. .t.e.s.k.e.e.r...{.0.}. .o.m. ...r.e.t...{.0.}. .p.r... .d.a.g...{.0.}. .p.r... .f.o.d...{.0.}. .p.r... .u.g.e...{.0.}. .p.r... .{.1.}...{.0.}. .e.n.g... .g.a.l...{.0.}. .a.c.r.e.-.f.o.d...{.0.}. .k.u.b.i.k.f.o.d...{.0.}. .e.n.g... .m.p.g...m.i.l./.e.n.g... .g.a.l...{.0.}. .b.u.e.m.i.n.u.t...{.0.}. .p.r... .g.r.a.m...{.0.}. .p.r... .m.i.n.....{.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\dua.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\dyo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\ebu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\ee.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):892
                                                                                                                            Entropy (8bit):4.395168612626523
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:bmmBuZCucVk1wmnOLU6LTWuZgh96Ved1Xq+8yTdYF96RkuTIrP42fs859JK:Q3cVfmOLUiWfu4dlVbdYyRZANsk9JK
                                                                                                                            MD5:21017141ED814E503ABBF8B2642B00BF
                                                                                                                            SHA1:7EFC40C7E8924AC172FC32C1DA610BCC71373BAD
                                                                                                                            SHA-256:859FC600BFFC411242836CCD551701AB20BD6D28F4C6C1115F844EAE0501943C
                                                                                                                            SHA-512:BB800BA94FBF0630F558359263F48233F3F8E6DF26420AE81F40170CF00A911B9ABE5D3B1DAB067FE370B0B9E9729B8149D69B9B40520C2219895A74A4020F38
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .h....................h.....91ci....e.....e.w.o...s. .{.0.}...K.k.e.k.e.....e. .{.0.}...g.a...o...o...k.T.s.i.V.a...c.l.e.t.i.w.o...K.k.e.k.e.w.o...g.a...o...o.w.o...k.T.s.i.V.a.w.o...K.k.e.k.e. .{.0.}...c.l.e.t.i. .{.0.}...a.V.a.b.a...o...o...k.T.s.i.V.a. .{.0.}...g.a...o...o. .{.0.}...s.e.k.e.n.d. .{.0.}...a.V.a.b.a...o...o.w.o...a.V.a.b.a...o...o. .{.0.}...s.e.k.e.n.d. .{.0.}. .w.o.....5...:.........5...:.........5...:.........5...:...........:.......5...:.........5...:.l.}.}...5...:.w.......5...:.........5...:.........5...:...........:.q.q...5...:.........5...:.i.}.}...5...:.........5...:.........5...:.........5...:...........:.......5...:.........5...:.l.}.}...[...c.w.d...c....P...P...P...P...P...P...P..J.... ..[...c.w.d...c....P...P...P...P...P...P...P..J.... ..[...c.w.d...c....P...P...P&..P-..P2..P9..P..J.... ......a.m...g..`... ... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_001.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4364
                                                                                                                            Entropy (8bit):4.681068579360723
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:JoR+9+o9dTZy9SRJEKygkQ+cxD/6uJP2u1:JoR+F9kSHEK+w6yn1
                                                                                                                            MD5:DC459400AE7D0038180CFE79BBFEE537
                                                                                                                            SHA1:339920C03428C68F64536287CCCD2976224BBD57
                                                                                                                            SHA-256:80A224F0790279544693604B8862861EA1E33CAF7F799B50409A8B5F58917927
                                                                                                                            SHA-512:F879219CFC66023C5EB78448AFFBCF7449FD3F854014E42D05C4396DDF6762DE0E6A79E5EECFF496302D748800B04629FACE0EEA581C7742768D36A9CD410A81
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................4.. ........;...;...........x...91ci..{.0.}.p.h...{.0.}.p.s...U.S. .g.a.l.....m.e.t.r.e.s...m.e.t.r.e.s.....{.0.}. .h.r.s...{.0.}.m.g./.d.l...{.0.}.g.a.l.U.S...{.0.}.m.p.g.U.S...{.0.}. .m.i.n.s...{.0.}. .s.e.c.s...l.i.t.r.e.s./.k.m...{.0.}./.g.a.l.U.S...m.e.t.r.e.s./.s.e.c...m.e.t.r.e.s./.s.e.c.....m.i.l.e.s./.g.a.l. .U.S...{.0.}. .U.S. .g.a.l.l.o.n...{.0.}. .p.i.c.o.m.e.t.r.e...{.0.}. .U.S. .g.a.l.l.o.n.s...{.0.}. .k.i.l.o.m.e.t.r.e.s...{.0.}. .m.i.c.r.o.m.e.t.r.e...{.0.}. .n.a.n.o.m.e.t.r.e.s...{.0.}. .p.i.c.o.m.e.t.r.e.s...m.i.l.l.i.m.o.l./.l.i.t.r.e...{.0.}. .d.e.c.i.m.e.t.r.e.s...{.0.}. .m.i.l.l.i.m.e.t.r.e...{.0.}. .c.e.n.t.i.m.e.t.r.e.s...{.0.}. .m.i.l.l.i.m.e.t.r.e.s...{.0.}. .c.u.b.i.c. .m.e.t.r.e...{.0.}. .c.u.b.i.c. .m.e.t.r.e.s...{.0.}. .s.q.u.a.r.e. .m.e.t.r.e...{.0.}. .s.q.u.a.r.e. .m.e.t.r.e.s...{.0.}. .p.e.r. .U.S. .g.a.l.l.o.n...{.0.}. .p.e.r. .k.i.l.o.m.e.t.r.e...{.0.}. .p.e.r. .c.e.n.t.i.m.e.t.r.e...{.0.}. .c.u.b.i.c. .k.i.l.o.m.e.t.r.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_150.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_BM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_CY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_FK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_FM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_GB.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):228
                                                                                                                            Entropy (8bit):4.044690676324035
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:Sv8pdFjZJSk+ounn+llGp2ldMkalvV5axen:RtJSfoun+lliwMdV5r
                                                                                                                            MD5:8EA764E277BE89178D6745E843E3F4A2
                                                                                                                            SHA1:209B98123D8A78B7C8FDF215FC34902A7BAD55BC
                                                                                                                            SHA-256:8972F48F140626B2A32943A3EF97524255B61ADA88DA3CA541E0755ACC23EC35
                                                                                                                            SHA-512:5B5EB388FAD554D19B2E79DB5D0D1341A2C81FF38771AB6AF360264EFC11C96C468D18387EFAB3C59A354B2256480B8266E168B0A25A0DC8436D58ABFB0089D9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................*.. ..T.....1...1..........T....91ci....5...:..C.C.C..5...:..T.T.T..5..C..5..T..:.....:.......X.`......P...P....... ..X.`......P...P.......P..!....P....8.j.... !.. #.. ........m......`C..`... %..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_GD.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_GG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM4MllSTNZlFj+n:SvRlI
                                                                                                                            MD5:31CB7B76C7956E45E041026558CFA226
                                                                                                                            SHA1:71216A3E97EBC506AB659D07B0FB60EC678A8F23
                                                                                                                            SHA-256:BC3D03EA300FBD81784FD96045E026CF8E03D0941EA2A64DFC7A062A7B9391E1
                                                                                                                            SHA-512:826E86F72D4B2D13ABE368EC598C3121C1822CB87BD3D1060E8194D5DA7E74E5A7F4784DEAD49E1F02FEF9BD36B01FD1202D72B1D2F8532F85791A20C243C07E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.D....................D.....91ci..........C.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):172
                                                                                                                            Entropy (8bit):3.8643130246325517
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlR9laCJ7lol/FBOlYClgxRtlRXk0bxC91Wh9/Fn3qfblX/F:SvL8CAhOlYpZLg9Ycld
                                                                                                                            MD5:9849FEE7A1ADA725213BF5491CCCC73C
                                                                                                                            SHA1:355418F1BA48CABE0DA73B73C5AEBF5D1DBF8014
                                                                                                                            SHA-256:409A055AB32E826AE7FB50047BCE02447F6F83A46A26AF1CE924F14A2501E7E5
                                                                                                                            SHA-512:FBD318B46F33736B364B9DC08EB7D171DCBC53311AE4CE74A95038CF84A8D9A1074E3ABCB2860F8E0F1DFF05F25EA94975BE25FCCE61DAD5EAD6B6859FC23744
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .<......#...#.........<.....91ci..2...1...4.9...1.4.......:.........:.;.;..........P....... .......P....... ......a.m......`=..`... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_JE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_KI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_LS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_MO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_MT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_MU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMmlfbTNZlFn:SvNt
                                                                                                                            MD5:4D8B9ED918A6A21826CF6ACDA10D7B8B
                                                                                                                            SHA1:DEC9BB0C1333322C691B9318A9FAD5E0987319E7
                                                                                                                            SHA-256:E26840BBAC4F0ED8E3601F62ABB775FCC16BF38B70785540025D1818F7057881
                                                                                                                            SHA-512:7AE98D692352C530AE50AB24C00C7F0AEB6C2F74C6B77EBBBDDF4BDD04B21E48816BF3F2698EE2B014D703F56F9E14958E28F298CD56027492C3A300FC4B619F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_NH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.7148996570578574
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlKelBjlgljl/Fu2Okl8:SBtkJTl46xka
                                                                                                                            MD5:B2A17B52F311F0F8BD19EEC1D270AA5D
                                                                                                                            SHA1:5597D0EB202F218C9B027A9F27B8C6187D996508
                                                                                                                            SHA-256:B60B69A397846AED406CCE1662AE4D08F41B5D1F1191D402CA1DD562822CC0E0
                                                                                                                            SHA-512:4A1ECA4483406AF775AD1C05C4C249378A499E0BFB09BA3D56FE4A685D9AA4681006B1EBA0CC614382F864A0D776B1A6ACF8F441424B21CE135DB41CCBB7318D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci..e.n._.V.U.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_NU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMg9lZNTNZlFb:SvbZh
                                                                                                                            MD5:5C178E2FA9F7BFAFD04671973597DA85
                                                                                                                            SHA1:77BEEB262833524FF0CB993F282ABEFC05B49323
                                                                                                                            SHA-256:DFECD526162A19ED0E877A733782593D1CF496E5D1435248C06BDF5386F36BBD
                                                                                                                            SHA-512:D4FAD5F465B41FA87DF52FB0BAE6A5C4CDD48C3C43BE1DAAE1DE9B55B962F217CB666F47F7980599CAAF0101AAD46895F2A3F07E872A1B44146EBC64CFF860B9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.|....................|.....91ci..........{.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_PW.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):136
                                                                                                                            Entropy (8bit):3.6674873990389525
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlb7XlBlTYL8uO1kMPUUcj/DgqNkZlEah/F:SvN39a7Pg3EahN
                                                                                                                            MD5:C624339EDAAF7564C53616BB31B0F7C5
                                                                                                                            SHA1:4207CC218B0682BF267FB1B2F1C2977F5BA5DA75
                                                                                                                            SHA-256:96A731D1EFA3FEABD62B024FB17E5C52CE6E67468893AD7B56320D43D0EB0C98
                                                                                                                            SHA-512:0CD605C7CC408CA9DBBE400875C9273A14855D9A92D0DC6961D88BC6461B5835396192DBD58176BE508DF9AFDF8449F4FAB209B857EE4A7559392ADFB68FA4AE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..'....................'....91ci......:.P.P.....:..'.'....).1......P...P....... ......a....`{..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_SI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.040932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMg9lZNTNZl+e:SvbZae
                                                                                                                            MD5:A3CD4CFB2A1BA42247C9686225807918
                                                                                                                            SHA1:4DB66651D6DE29451CEB1B9ED9E188D6D6EADEA0
                                                                                                                            SHA-256:C8CA7FA12F4F74D2B7C10823015519765426403B9535B57A08D7BAF694AE7521
                                                                                                                            SHA-512:EB7F4C10D3B593FC6B4D436291E5E990001C5BC74B1DA545C69898CCEB5D126F9CD9A589945672E3D0380392F949B62256FF954BCE19DC19502CD8BC5EA8611C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.|....................|.....91ci..........{.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_SL.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMg9lZNTNZlFb:SvbZh
                                                                                                                            MD5:5C178E2FA9F7BFAFD04671973597DA85
                                                                                                                            SHA1:77BEEB262833524FF0CB993F282ABEFC05B49323
                                                                                                                            SHA-256:DFECD526162A19ED0E877A733782593D1CF496E5D1435248C06BDF5386F36BBD
                                                                                                                            SHA-512:D4FAD5F465B41FA87DF52FB0BAE6A5C4CDD48C3C43BE1DAAE1DE9B55B962F217CB666F47F7980599CAAF0101AAD46895F2A3F07E872A1B44146EBC64CFF860B9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.|....................|.....91ci..........{.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_SS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMg9lZNTNZlFb:SvbZh
                                                                                                                            MD5:5C178E2FA9F7BFAFD04671973597DA85
                                                                                                                            SHA1:77BEEB262833524FF0CB993F282ABEFC05B49323
                                                                                                                            SHA-256:DFECD526162A19ED0E877A733782593D1CF496E5D1435248C06BDF5386F36BBD
                                                                                                                            SHA-512:D4FAD5F465B41FA87DF52FB0BAE6A5C4CDD48C3C43BE1DAAE1DE9B55B962F217CB666F47F7980599CAAF0101AAD46895F2A3F07E872A1B44146EBC64CFF860B9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.|....................|.....91ci..........{.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_TT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMg9lZNTNZlFb:SvbZh
                                                                                                                            MD5:5C178E2FA9F7BFAFD04671973597DA85
                                                                                                                            SHA1:77BEEB262833524FF0CB993F282ABEFC05B49323
                                                                                                                            SHA-256:DFECD526162A19ED0E877A733782593D1CF496E5D1435248C06BDF5386F36BBD
                                                                                                                            SHA-512:D4FAD5F465B41FA87DF52FB0BAE6A5C4CDD48C3C43BE1DAAE1DE9B55B962F217CB666F47F7980599CAAF0101AAD46895F2A3F07E872A1B44146EBC64CFF860B9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.|....................|.....91ci..........{.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\en_TV.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMg9lZNTNZlFb:SvbZh
                                                                                                                            MD5:5C178E2FA9F7BFAFD04671973597DA85
                                                                                                                            SHA1:77BEEB262833524FF0CB993F282ABEFC05B49323
                                                                                                                            SHA-256:DFECD526162A19ED0E877A733782593D1CF496E5D1435248C06BDF5386F36BBD
                                                                                                                            SHA-512:D4FAD5F465B41FA87DF52FB0BAE6A5C4CDD48C3C43BE1DAAE1DE9B55B962F217CB666F47F7980599CAAF0101AAD46895F2A3F07E872A1B44146EBC64CFF860B9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.|....................|.....91ci..........{.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\es.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12020
                                                                                                                            Entropy (8bit):5.393626379908496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:Mpe019B/w/uOSo9DTz5W7B4oMmzissz36YlSwaC:Mpe01bYnDTz5502q/a
                                                                                                                            MD5:4C03277AFDBA71E7BE51F8958B241278
                                                                                                                            SHA1:4838AF4FEB9D39ADD15B402249B9DF1E94DC8C10
                                                                                                                            SHA-256:FAC0DEE8E2A1202A42040C380A7D7F06B744DAEDAA6A9BA9F204038885FECFC1
                                                                                                                            SHA-512:0FFB8A0394A448C5C39FBA26E815CE61EA136569C8D469F11821F7D8FB99504B948C3435BA360ECA3C254AA50A8A9C6A7A95BA2D4E4BE906C92ADA67BA16B20C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..........................91ci..{.0.}...0 ..g.r.a.d.....{.0.}. .F.g...{.0.}.a...l.....{.0.}. .c.d.a...{.0.}. .p.i.e...{.0.}./.s.e.m...{.0.}. .s.i.g.....{.0.}. .c.d.t.a...f.u.e.r.z.a. .G...{.0.}. .n.u.d.o...{.0.}. .p.i.e.s...{.0.}. .p.t.o.....{.0.}. .t.a.z.a...{.0.}. .t.a.z.a.s...{.0.}. .n.u.d.o.s...{.0.}. .p.t.o.s.....{.0.}.m.i. .e.s.c.....{.0.}. .s.i.g.l.o.s...{.0.}. .y.a.r.d.a.s...l.i.b.r.a. .p.i.e.s...{.0.}. .d.u.n.u.m.e.s...{.0.}. .a...o. .l.u.z...{.0.}. .p.o.r. .a...o...{.0.}. .p.o.r. .p.i.e...{.0.}. .d.a.l.t.o.n.e.s...{.0.}. .a...o.s. .l.u.z...{.0.}. .b.a.r.r.i.l.e.s...{.0.}. .p.u.l.g.a.d.a.s...l.i.b.r.a. .f.u.e.r.z.a...{.0.}. .a.t.m...s.f.e.r.a...{.0.}. .c.u.c.h.a.r.a.d.a...{.0.}. .k.i.l...m.e.t.r.o...{.0.}. .l.i.b.r.a. .p.i.e...{.0.}. .p.o.r. .g.a.l...n...{.0.}. .p.o.r. .c.i.e.n.t.o...{.0.}. .a.t.m...s.f.e.r.a.s...{.0.}. .c.u.c.h.a.r.a.d.a.s...{.0.}. .k.i.l.o.g.r.a.m.o.s...{.0.}. .k.i.l...m.e.t.r.o.s...{.0.}. .p.i.e. .c...b.i.c.o...{.0.}. .

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\es_BO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMg9lZNTNZl7d:SvbZF
                                                                                                                            MD5:9E46895540FD75BA1C21CC8BCA9446B4
                                                                                                                            SHA1:09C5D01771B26A3F003757FD9788D13C0F10AE26
                                                                                                                            SHA-256:56B0002469F572CFD0CB8C8BECEA7A1005EA8F7ED1D3DD308E0C4AD28A88F0C6
                                                                                                                            SHA-512:B7B792042ABA5729EB852ECDA456087F05E459641F62C1BC6E951F3BD72A81B8C6D55A995FC07BFFD2CE342CF87618010A4AD63271CA4518950C9B93B9B6DF85
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.|....................|.....91ci..........{.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\es_GT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):576
                                                                                                                            Entropy (8bit):4.578386550300064
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:JyicxElUBM9IlAax+U+i/2mMneG0PAnqIYmak+n399Z+E:JFcxVBM9IlLYUnanZ0fhxVH
                                                                                                                            MD5:58C20A26E67A5E433C49DC9A273F4E50
                                                                                                                            SHA1:2A895CCAE49F44C9257B127F33304C987057E3DE
                                                                                                                            SHA-256:6890E7C42409C74B2E65DC51D4D28AED0C6C70F5A11A7221D7432E0935180D59
                                                                                                                            SHA-512:4604EA7EBC8705CD422E748079DC735534F0F244E2F6E789B2121DDBB008F73E3CBC14C62B7CF926DC03485259B288FF938AD472016A8B6D18232A737E644434
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ......................N...91ci..a.c.r.e. .p.i.e...{.0.}. .a.l. .a...o...{.0.}. .a.l. .d...a...{.0.}. .a.l. .m.e.s...{.0.}. .p.o.r. .p.i.e. .c...b.i.c.o......................5...:..xT3.>..5...:..x8o.x....:....'....:..(<3..5...:..d{..+..5...:..d.R.d....:...........5.......:.......5.@3..5..B..5..q..5.....[.w.c.>..PA..PD..P............G..PN..PU..PZ..P........_..Pf..P..F.m..P....r..P..J.....K.j.N.. S.. Z.. ^.. `.. ....u..P..J.j.. ....x..P....}..P..v....P..U....P..q....P......:.K.j.n.. p.. r.. t.. v.. ........a.m....`{..`b.. l.. x..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\es_PE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMKl/pxlBlllcENZl7r:Svll/aMj
                                                                                                                            MD5:F616941B9E4A6D0FFA96433EFC906C6D
                                                                                                                            SHA1:622E12F3D922AE8887FD13DAAE6C1302358F019E
                                                                                                                            SHA-256:E4FC1C6EAC3A76A7EFBC3C4B106882377EE5B0BA51B2D99E5817C4F01501EC0D
                                                                                                                            SHA-512:E10DF0439CD189B1DA769E3F21CF676456B42189A54B01957371A2A8087CC65E369AC1F1983566FC884A85812DFD14201E1B5ACD886D5300B57B6E8FC05995AE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\es_PR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):116
                                                                                                                            Entropy (8bit):3.5029288909356517
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tld1NlTYZkOgsl8pNkZlEHG2DNn:SvBPOgsl8pN6Em2B
                                                                                                                            MD5:4DC5B0A5A3AE19CF4902147939532DC8
                                                                                                                            SHA1:D55CD66155C72609071E12A017F7FB0089B1312A
                                                                                                                            SHA-256:9EEA81C3EFD3E97E23E6E6990626FEFAAD297343E3957AC5C1394FAB58625215
                                                                                                                            SHA-512:4DFB13CEC1072E60DE0EB278BA490004B828808FFF87FF6EB027E31E7F36EE972D2B7ABC481B3883A2F147B423CB8BDAFB176C550F4B0A06AD1DA96871D3E638
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..'....................'....91ci......:..'.'..1....P....... ......a....`{..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\es_VE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMg9lZNTNZl7d:SvbZF
                                                                                                                            MD5:9E46895540FD75BA1C21CC8BCA9446B4
                                                                                                                            SHA1:09C5D01771B26A3F003757FD9788D13C0F10AE26
                                                                                                                            SHA-256:56B0002469F572CFD0CB8C8BECEA7A1005EA8F7ED1D3DD308E0C4AD28A88F0C6
                                                                                                                            SHA-512:B7B792042ABA5729EB852ECDA456087F05E459641F62C1BC6E951F3BD72A81B8C6D55A995FC07BFFD2CE342CF87618010A4AD63271CA4518950C9B93B9B6DF85
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.|....................|.....91ci..........{.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\et.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20160
                                                                                                                            Entropy (8bit):4.748356832411956
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:COCKXHE0Ahg5nm9VnEzH2EujuSUUWqSss7/lE63cyv5+e4jcmk5eX53bxgYW95gY:qGuEzH3Tmk+MXhZ8XbcXfjoX0Aa+M6I7
                                                                                                                            MD5:017493C71CB00B7CBB897FCD0A38A59E
                                                                                                                            SHA1:0AE1B830D2C549E4E5978C2C87B6FA045D1F8B4B
                                                                                                                            SHA-256:07006BFEC02F4A199B2EEFE81879EF37C1C4DF3A0763E1C611ABB49E74BC4EB4
                                                                                                                            SHA-512:ABEBA452B8EF35FCEEAB554BA1C64BEDD9B92CEF4C6F65C5181152F835145341629F03EA13747D223B51F3749AF64F05FEE3DB489220DAE25904CE5A7A7CB423
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .`....................`.....91ci..k.i.v.i.d...o.o.m.i.d...{.0.}./.k...{.0.}. .a.....{.0.}. .h.j...s...l.l.a.d...a.a.k.r.i.d...m.o.o.l.i.d...{.0.}. .i.p...{.0.}. .l.l...{.0.}. .l.p...{.0.}. .p.l...{.0.}. .s.a.j...{.0.}. .s.p.l...d.u.n.a.m.i.d...p.u.n.k.t.i.d...{.0.}. .k.u.u...{.0.}. .n...d...{.0.}./.n...d...k.W.-.t.u.n.d...k.v.a.r.d.i.d...n...d.a.l.a.d...{.0.}. .o.o.m...{.0.}./.s.e.k...{.0.}./.....p...{.0.}. .k.u.u.d...p.a.r.s.e.k.i.d...b.u.a.a.e.l.i.d...d.a.l.t.o.n.i.d...h.e.k.t.a.r.i.d...k.a.r.a.a.d.i.d...{.0.}. .b.a.i.t...{.0.}. .j.a.l.g...{.0.}. .k.i.v.i...{.0.}. .m.i.i.l...{.0.}. .t.o.l.l.......p...e.v.a.d...{.0.}. .m.o.o.l...{.0.}. .s...l.m...{.0.}. .t.a.s.s...b.a.r.r.e.l.i.d...k.e.l.v.i.n.i.d...s.a.j.a.n.d.i.d...{.0.}. .b.i.t.t...{.0.}. .k.u.u.s...{.0.}. .n.a.e.l...{.0.}. .o.o.m.i...{.0.}. .p...e.v...{.0.}. .s...l.d...{.0.}. .t.u.n.d...{.0.}. .u.n.t.s...{.0.}. .l...h. .t...j...u.n.a.e.l.a.d...f.u.r.l.o.n.g.i.d...r.u.u.t.j.a.l.a.d...k.i.l.o.v.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\ewo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\ff_CM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.945547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/csyMmllZn:SBtkJYlU8g8l/knlzn
                                                                                                                            MD5:6531B41F94F0C023EA9A39B05C6FB84B
                                                                                                                            SHA1:64BDFFF943DD28467054EDE432FA0403169A6334
                                                                                                                            SHA-256:B1CC805BA88346F9FAD694C30084B1959F9E786D862EE4458DC395BA021823D3
                                                                                                                            SHA-512:2CD388003FB69FA7EB82DFB6D44A3E06B68A78B9B44902024BBE99ECB5387C2A7A04529267AE7BE52CADD372B02837E786D4BD6E8A69E021BA7E4F80F8A565F4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci..f.f._.L.a.t.n._.C.M...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\fil.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15044
                                                                                                                            Entropy (8bit):5.081373986205722
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:eglvm9xEoqtVIzFDKiiRp+5jL+SUm8Wjn:HWxqtVIzQv+N+SUmDn
                                                                                                                            MD5:A75E87DA1FB2541F6973C3DA1615C649
                                                                                                                            SHA1:D456C2288906A660AD5F683A8EDCD29D39217E82
                                                                                                                            SHA-256:2E1786D2BCA98C7239FF3C373DEE7789217285672D6ADD315D8BE68B7838011D
                                                                                                                            SHA-512:98E262F3D6ADE188D4741E93BE09AC78D18A4C2E770CE0535676244B4E241E9ED5D25703352EA1EDA376C1A7916ADC1D30760DAB85796FE950EEFDF853B5BFC5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................91ci..p C...p.t.s...{.0.}.H.....s.e.g...m.s.e.g...m.i./.h.r...{.0.}. .K.D.....m.e.t.r.o...d.e.g... .K...m.e.t.r.o.....y.a.r.d.a.....y.a.r.d.a.....{.0.}.t.a.o.n...n.a.n.o.s.e.g...m.i.l.i.s.e.g...s.q. .m.i.l.e...{.0.}. .a.r.a.w...{.0.}. .o.r.a.s...{.0.}. .t.a.o.n...{.0.}./.a.r.a.w...{.0.}. .k.i.l.o...{.0.}.b.u.w.a.n...{.0.}. .t.a.s.a...{.0.}./.t.a.o.n...{.0.}. .o.n.s.a...l.i.t.r.o./.k.m...m.g.a. .o.r.a.s...m.g.a. .t.a.o.n...p.u.l.g.a.d.a.....p.u.l.g.a.d.a.....{.0.}. .b.u.w.a.n...{.0.}.l.i.n.g.g.o...m.e.t.r.o./.s.e.g...m.g.a. .b.u.w.a.n...m.g.a. .s.i.g.l.o...m.i.l.y.a./.g.a.l...{.0.}. .n.a. .l.y...{.0.}. .n.a. .m.c...{.0.}. .n.a. .p.c...{.0.}. .n.a. .p.m...{.0.}. .n.a. .y.d...{.0.}./.b.u.w.a.n...{.0.}. .l.i.n.g.g.o...{.0.}. .n.a. .m.p.t...{.0.}./.l.i.n.g.g.o...m.g.a. .l.i.n.g.g.o...m.g.a. .m.i.n.u.t.o...m.i.l.y.a./.o.r.a.s...{.0.}. .n.a. .b.i.t...{.0.}. .n.a. .d.e.g...{.0.}. .n.a. .g.a.l...{.0.}. .n.a. .l.u.x...{.0.}. .n.a. .

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\fo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):13300
                                                                                                                            Entropy (8bit):5.062980967084747
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WFBU8GLBJHxKQFvTnkcmEVoE4p4RI4J4fW0BWS3fcwHiYPzL4n+:SBUJJ5znm1iZC+SWS3vp4+
                                                                                                                            MD5:3DABB114B27AEAD5A07BF429DE29A4F3
                                                                                                                            SHA1:348C56AD959BDC7B2E02FD688BBE3244101416A4
                                                                                                                            SHA-256:9769E6AB898659935A5B8CC4EAD3CA4A3C86BDC68C6FFDC8BEBA449B0B93D6F4
                                                                                                                            SHA-512:E4CACF5BB56A5F0EB808B488619477B91BB51A33C1E8EC8786E1F941C91CF54EB51C04D49044701045377A70E2B8738DD97707132269A7CAF37398664A9DA1B5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .w....................w.....91ci..{.0.}...r...{.0.}.t.....{.0.}.v.....{.0.}. ...r...{.0.}.m.s.....{.0.}. .......{.0.}./...r...{.0.}. .b...t...{.0.}. .m...l...{.0.}. .p.k.t...{.0.}. ...s.....{.0.}. .m.s.....{.0.}. .v.i.....{.0.}./.f...t...{.0.}. ...l.d...{.0.}./.v.i.....{.0.}. .s.t.i.g...{.0.}. .m...n.....{.0.}. .m...l.....{.0.}. .e.k.r.a...{.0.}. .m...l.....{.0.}. .s.n.......{.0.}. .t.u.m.....{.0.}. .u.n.s.a...{.0.}./.m...l.....{.0.}./.t.u.m.....2...1...4.8...9...{.0.}. .f...t.....{.0.}. .t...m.i...{.0.}. .v.i.k.a...{.0.}./.u.n.s.u...{.0.}. .m...l./.t...{.0.}. .u.n.s.u.r...{.0.}. .t.e.s.k.....{.0.}. .t.u.m.......{.0.}. .f...t.u.r...{.0.}. .f...t.u.r...{.0.}. .t.u.m.......{.0.}. ...l.d.i.r...{.0.}./.t.u.m.......m.i.k.r.o.s.e.k.....{.0.}. .l.i.t.u.r...{.0.}. .m.e.t.u.r...{.0.}. .t.u.m.m.i...{.0.}. .t...m.a.r...{.0.}. .s.j...m...l...{.0.}. .s.m...l./.t...{.0.}. .f.e.r.m...l...{.0.}. .k.o.p.p.u.r...{.0.}. .f...t.u.r.....{.0.}. .f...t.u.r.....{.0.}. .e.y.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\fr.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20012
                                                                                                                            Entropy (8bit):4.889244556728978
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:3v616sK0ClHiNnF6mw0CVmP8mGY0PM1dFjlGqaY:f4C0F6mw0X0PMDPVaY
                                                                                                                            MD5:9D5764E76638394E0485835CE73F84E0
                                                                                                                            SHA1:7851AF4721AB80356A042918BB320733C2917068
                                                                                                                            SHA-256:43C70995F7005BE5203FB96EC0878F4B96D4C557673A1C77EE1A697E95ECE524
                                                                                                                            SHA-512:8FEFC22DD116A116802B5AFE955F08684EF7450043E3F0C1A4592D9F473A4C071C78E1BD941B4329EC51F14FD570D7F2B46B2A2641D9184C5C8B762FD4073545
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................{.. .X....................X.....91ci..3 H.g...{.0.}./ N...{.0.}./ g...{.0.}./ h...{.0.}./ j...{.0.}./ l...{.0.}./ s...{.0.}./ A...{.0.}./ J...{.0.}./ K...{.0.}./ V...{.0.}./ W...{.0.}./ t...{.0.}./ ....{.0.}./ 0 ..{.0.}./ 1 ..{.0.}.c.h...{.0.}.u.a...{.0.}./ m...{.0.}./ o...{.0.}./ E...{.0.}./ O...{.0.}./ S...{.0.}./ c.t...{.0.}./ M.l...{.0.}./ a.l...{.0.}./ c.m...{.0.}./ h.l...{.0.}./ k.g...{.0.}./ k.m...{.0.}./ l.x...{.0.}./ m.....{.0.}./ m.m...{.0.}./ m.s...{.0.}./ m.....{.0.}./ n.d...{.0.}./ p.i...{.0.}./ p.o...{.0.}./ u.a...{.0.}./ ..C...{.0.}...s.....{.0.}./ D.a...{.0.}./ G.W...{.0.}./ G.o...{.0.}./ H.z...{.0.}./ L..&..{.0.}./ M.W...{.0.}./ M.o...{.0.}./ M.."..{.0.}./ M..&..{.0.}./ P.o...{.0.}./ R..&..{.0.}./ T.o...{.0.}./ a.c...{.0.}./ c.h...{.0.}./ d.m...{.0.}./ e.V...{.0.}./ h.a...{.0.}./ k.J...{.0.}./ k.W...{.0.}./ k.o...{.0.}./ l.b...{.0.}./ m.A...{.0.}./ m.W...{.0.}./ m.g...{.0.}./ m.i...{.0.}./ m.....{.0.}./ n.m...{.0.}./ n.s...{.0.}./ o.z...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\fr_CA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10868
                                                                                                                            Entropy (8bit):4.868626587414015
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:7iQalBBLRP0memzcKbJb2fRsNw/SK3XkeVsNKMxB7gA8enK6CMX42541gSY:5al32memzcEw/mNfr94hY
                                                                                                                            MD5:DF4CA241DF2B2CB331C23579CDEE3EFE
                                                                                                                            SHA1:055046C8F97EBC6ECD99F286CAC37EA418B6C9F6
                                                                                                                            SHA-256:61DC72F03AE6CE930899CB5D02C36E033183330E2D173A1328D87FA25C70E713
                                                                                                                            SHA-512:1C6D528C6376EF4A49F93D4D39EA037397ED733DC388CFDDE11DBA8092FCF4491BAE35AF34D0A978E28EDF67F9181D809B63B3CF741FCC2F553EE836D566D85F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..}....................}....91ci..{.0.}.t.c...{.0.}.N.M...{.0.}.a.l...{.0.}.n.d...{.0.}.p.i...{.0.}.p.o...{.0.}.v.g...{.0.}...s...{.0.}. .G.o...{.0.}. .M.o...{.0.}. .T.o...{.0.}. .c.h...{.0.}. .k.o...{.0.}. .p.o...{.0.}. .t.c...{.0.}...N.M...{.0.}...v.g...{.0.}. .p.i...{.0.}. .v.g...{.0.}...p.i...{.0.}...u.a...{.0.}.....C...{.0.}. .v.g.....{.0.}. .a.n.s...{.0.}. .p.o.....{.0.}. .p.o.....{.0.}...p.i.....{.0.}...p.s.i...{.0.}...p.t.e...{.0.}...v.g.....f.o.r.c.e. .G...{.0.}. .p.i.....{.0.}. .p.t.e...{.0.}. .v.g.....{.0.}./.s.e.m...{.0.}...p.i.....{.0.}. .c.h.o.p...{.0.}. .m.o.i.s...{.0.}. .j.o.u.r...{.0.}. .o.n.c.e...{.0.}. .p.i.e.d...{.0.}. .o.c.t.e.t...{.0.}. .l.b.-.p.i...{.0.}...p.o. .H.g...{.0.}. .d.e.g.r.....{.0.}. .h.e.u.r.e...{.0.}. .j.o.u.r.s...{.0.}. .m.i.l.l.e...{.0.}. .m...t.r.e...{.0.}. .o.u.e.s.t...{.0.}. .p.o.u.c.e...{.0.}...v.e.r.g.e...{.0.}. .v.e.r.g.e.s...{.0.}. .d.e.g.r...s...{.0.}. .g.r.a.m.m.e...{.0.}. .h.e.u.r.e.s...{.0.}. .l.i.v.r.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\fr_HT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):452
                                                                                                                            Entropy (8bit):3.9471071501604382
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:i3ALEPoq0wq0wYDGdOY3H0Gdos6yFGfTHhxVP:iwLyo1w1FDEX0Fs1F8LhxV
                                                                                                                            MD5:243D1302D7C328418F1E9A6E2B73CDF1
                                                                                                                            SHA1:7045BAE90A58F0ADF05B6A64CC709D7EE39D255E
                                                                                                                            SHA-256:7B0F28AA6E2066CBBDA528B1A38471CBA87205826A77CD098A6254224BA41F3E
                                                                                                                            SHA-512:0F1A9BB383F371151DF7FEF9D28085A48A30C1211E91D66A30A61765D44962C782D511EFA988C345A1125272AFF3CCF9A4EAC727889122F78693EA576FBB4917
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................b.. ..0.....i...i..........0J...91ci..g.r.....{.0.}.k.r...{.0.}.g.r...{.0.}.c.a.r.r.e.a.u...{.0.}.c.a.r.r.e.a.u.x...{.0.}. .p.o.u.r. .c.h.a.q.u.e. .m.e.t.r.e. .c.u.b.e...{.0.}. .p.o.u.r. .c.h.a.q.u.e. .c.e.n.t.i.m.e.t.r.e. .c.u.b.e.....5...:.)0&010....X0....=0..5..0..5..0..5...:..0.0.0....:. 0 0....c..P........j..Pm..P....j...J.. L.. ....p..P..8.T.. ..S.s..P........v..P}..P..J.8...X.. Z.. ......a.m...{..`P.. V.. ^..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\fy.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3936
                                                                                                                            Entropy (8bit):5.218369961499987
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:F2/kSmh1rjfPEYjB8FfMsOfDkknCZIpKacZP4L:P1djCFfslNpik
                                                                                                                            MD5:5BDF3315281153E636EBD136A8845E73
                                                                                                                            SHA1:676ED0061FC25F98780F73A38813C08A6D63E42A
                                                                                                                            SHA-256:3D6CBF05380EAD90AE3FA495F68F5F911A1A4B3479FAD2889F264F4D9F47646B
                                                                                                                            SHA-512:EE27967062D81545258633878613C5B0F6C59B0BE0F329CA3355126F0CB671BFD83F67FE878B8ADE52F37F5EC96EFF7E5362F1D6605BFD3471B7A6B4B77E6838
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................91ci..{.0.}. .j.r...{.0.}. .m.y.l...{.0.}. .a.r.e...{.0.}. .d.e.i...{.0.}. .w.k.n...{.0.}. .o.e.r.e...{.0.}. .f.o.e.t...{.0.}. .a.r.e.s...{.0.}. .j.i.e.r...{.0.}. .w.i.k.e...{.0.}. .d.e.i.e.n...{.0.}. .w.i.k.e.n...{.0.}. .t.o.m.m.e.n...{.0.}. .m.o.a.n.n.e...{.0.}. .h.e.k.t.a.r.e...{.0.}. .m.o.a.n.n.e.e.n...{.0.}. .s.e.k.o.n.d.e.n...{.0.}. .b.o.o.g.m.i.n...t...{.0.}. .l.j.o.c.h.t.j.i.e.r...{.0.}. .k.u.b.i.k.e. .m.y.l...{.0.}. .m.y.l. .d.e. .o.e.r.e...{.0.}. .h.y.n.s.t.e.k.r...f.t...{.0.}. .b.o.o.g.s.e.k.o.n.d.e.n...{.0.}. .m.i.l.l.i.s.e.k.o.n.d.e.n...{.0.}. .h.y.n.s.t.e.k.r...f.t.e.n...{.0.}. .f.j.o.u.w.e.r.k.a.n.t.e. .m.y.l...{.0.}. .k.u.b.i.k.e. .k.i.l.o.m.e.t.e.r...{.0.}. .m.e.t.e.r. .d.e. .s.e.k.o.n.d.e...{.0.}. .f.j.o.u.w.e.r.k.a.n.t.e. .f.o.e.t...{.0.}. .k.i.l.o.m.e.t.e.r. .d.e. .o.e.r.e...{.0.}. .f.j.o.u.w.e.r.k.a.n.t.e. .m.e.t.e.r...{.0.}. .f.j.o.u.w.e.r.k.a.n.t.e. .k.i.l.o.m.e.t.e.r...........!.......5...:.LgMEHg..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\gu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15020
                                                                                                                            Entropy (8bit):5.438754249792362
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:jlNk6C0xU+CIV3whCBhvqdgFgImX84SkhTQUeVqx/PRvkeiIW4vgZDx8d8R:jPkkO4fRqnVQFCHRv6oA18+R
                                                                                                                            MD5:F57075E98EDEA1CA8EE2ADCE95DE727A
                                                                                                                            SHA1:78192E7525106F75225FA9E6ACA7673D98EADADF
                                                                                                                            SHA-256:F0D60C43FCD628071777D0ADD6523ECDC489C18BA2C39F1B17E620C53958A4C6
                                                                                                                            SHA-512:14663E1BEEF54BF19D24E394E7AD720F2B845623CF8982DFF670857899009BB2D18C3F9078AD2346EC56BC0199E1754CD357EEE49FACD51CC204FDF0FFD7FF52
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..=....................=....91ci..{.0.}.....{.0.}.....{.0.}.....{.0.}. ."...{.0.}. .'...{.0.}. .....{.0.}. .....{.0.}. .....{.0.}.......{.0.}./.....{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}./.......{.0.}./.......{.0.}./.......{.0.}./.....................{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}./.........{.0.}./.........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. .........{.0.}./.........{.0.}./. .......{.0.}./.........{.0.}./.........................{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}. ...........{.0.}./.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\ha_NE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.4007237652827222
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQwl8t8WolUE+l2iAllfPAkll1:SvXl8t8FlUrl2iA/Ak9
                                                                                                                            MD5:C177B7AA90760FB221186EBCB1EFDD58
                                                                                                                            SHA1:3DCA7953EE83E5AA19331259E3CDBA45FE64DECD
                                                                                                                            SHA-256:B4C6C502D250FF8DD61D2867C70F1C7719C15390561075A4FEA0E47304950244
                                                                                                                            SHA-512:6E133FD97246DEB378888AF541353ABFF1ADCADA02E2F915099EA1D08F77956CA95284D83F7300440BA93C991C58AD574579F58424B47EF45B59D88EC625B1E0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................91ci..........!................`...P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\hi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):13408
                                                                                                                            Entropy (8bit):5.390599142540395
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:Vl8llSg7xEIIflnlFidJJJGHkBtY1y1tvUyl0ju:3mL8r1y1lUylp
                                                                                                                            MD5:48F871CB77A03A83BF1FEF28E820A4AC
                                                                                                                            SHA1:8B99F6804736372BCA2F635DEF63DDD32909A6FA
                                                                                                                            SHA-256:F0E0908070F44D09F063A3F401D8E24493108CB1BC2B867BE029D937E2F2B43E
                                                                                                                            SHA-512:4BAE6ADA2A352A9AE738C1593FB2B6429F0E0D1D2225CC3BD4A110E6FB911DA36A04026BEF79528C8A9C9CF2A14325EB57A01AAA8B2CECA35463D0ACFB9F7586
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................91ci..{.0.}.......{.0.}...@...{.0.}.5.I...{.0.}. ...*...{.0.}.&.?.(...{.0.}...>.9...{.0.}...@.2...{.0.}. .......{.0.}. ...p...{.0.}. ...@...{.0.}.....p...{.0.}...A.p...{.0.}.....p...{.0.}...?.p...{.0.}.2.@.p...{.0.}.8.G.p...{.0.}.9.G.p...{.0.}./...@.......M.*.@.p...{.0.}. .....6...{.0.}. .(.I.....{.0.}...8.G.p...{.0.}. .........{.0.}. .....8...{.0.}. .&.?.(...{.0.}. .,.?.....{.0.}. ...>.9...{.0.}. ...@.2...{.0.}.5.0.M.7...{.0.}.....!.<...{.0.}./.........{.0.}./.....8...{.0.}. ...H.p...{.0.}. .6.$.>...{.0.}. .....p...{.0.}. ...B.2...{.0.}. ...?.p...{.0.}. .2.@.p...{.0.}. .5.I.....{.0.}. .8.G.p...{.0.}. .9.G.p...{.0.}.....*.@...{.0.}./.....p...{.0.}./.&.?.(...{.0.}./...>.9...{.0.}./.2.@.p...{.0.}./.8.G.p...{.0.}. .!.K.(.....{.0.}. .,.H.0.2...{.0.}. .....!.<...{.0.}. ...H.2.(...{.0.}. .*.?.......{.0.}. .*.L...!...{.0.}. .,.>.......{.0.}. ...H.0.....{.0.}. .2...M.8...{.0.}./.*.L...!...{.0.}. .+.<.@.....{.0.}./...?.(.......@.2.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\hsb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14884
                                                                                                                            Entropy (8bit):5.311890721101611
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:kbbxETvMSqU6dzpEcsq5AZqQJFNZ52lyy+nG5elTrHNu5xVptSYeY:5tj2Ey+n3RM5xVj
                                                                                                                            MD5:883FCA1C6A6B724D39F88C1D90B96AA3
                                                                                                                            SHA1:1410A7A0F4B820E4C440393C65EB7847D0EA38DF
                                                                                                                            SHA-256:8843EB32F3601B27420FA30F753A8945F7EFCA0E173E73977FEFA704BF7E3D33
                                                                                                                            SHA-512:5366BD5D7A3F8F27022500253D4FF6DA0BDBCAA29F157AB9252F07235002317F7B7D48EB9D15CA673209395DD9642461B36F7442EB3F964301BA0C030DEB79E1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................y.. ......................g...91ci..{.0.}. .a.....{.0.}. .B.~.....a.m...t.o.n.y...{.0.}. .c...l...{.0.}. .d.z.....{.0.}. .l...t...{.0.}. .m...s.....{.0.}. .B.~.k.....{.0.}. .u.n.c.y...{.0.}. .a.c.r.y...{.0.}. .c...l.e...{.0.}. .d.z.e.D...{.0.}. .l...t.a...{.0.}. .l...t.o...{.0.}. .l.....e...{.0.}. .h.o.d.z.....{.0.}. .t.y.d.z.....{.0.}. .B.~.i.c.y...{.0.}. .a.a.l.k.i...{.0.}. .a.c.r.a.j...{.0.}. .a.c.r.o.w...{.0.}. .b.i.t.a.j...{.0.}. .c...l.e.j...{.0.}. .c...l.o.w...{.0.}. .d.n.j.e.j...{.0.}. .m...s.a.c...{.0.}. .o.h.m.a.j...{.0.}. .B.~.i.c.a...{.0.}. .a.a.l.c.e...{.0.}. .a.a.l.k.a...{.0.}. .m.i.n.u...e...{.0.}. .m...s.a.c.y...{.0.}. .B.~.i...k.i...{.0.}. .b.y.t.e.a.j...{.0.}. .g.r.a.m.a.j...{.0.}. .j.o.u.l.e.j...{.0.}. .l.i.t.r.a.j...{.0.}. .m.e.t.r.a.j...{.0.}. .p.i.n.t.a.j...{.0.}. .p.u.n.t.a.j...{.0.}. .s.t.o.p.j.e...{.0.}. .s.t.o.p.o.w...{.0.}. .t.y.d.z.e.D...{.0.}. .v.o.l.t.a.j...{.0.}. .w.a.t.t.a.j...{.0.}. .y.a.r.d.a.j...{.0.}. .B.~.i.c.o.w...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\is.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17340
                                                                                                                            Entropy (8bit):5.050776509041609
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mREwBdbJsHmcmlJpA2nBCtlu9Vr9deFsF:qxnBCfsr9dHF
                                                                                                                            MD5:AC858DA404C2D1DDD4F55792178D943D
                                                                                                                            SHA1:ACDF2F8F537A7B061C4B6F88DB489A7EA32B2604
                                                                                                                            SHA-256:AB8D8F8323D47054142CB79190D51CA2844BA83FDDE38FBA4192F2895BAEB7E2
                                                                                                                            SHA-512:C956624A54DC3886EEE62E5AB5D0BE65B70E3927B9E307477390B6AE80E6776CE21D5B2326CB2FF17752267482BEE41A315087AFFA438E5C2569E0EA6EC38DDD
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .w....................w.....91ci..{.0.}.....P.b...t...m.....l.....s.e.k.....{.0.}. .m.....{.0.}. .s.e...{.0.}. ...r...{.0.}...r.h...{.0.}. .h.....{.0.}. .e.k...{.0.}. .p.....{.0.}. .t.....{.0.}. .t.....{.0.}. .v.....{.0.}.m.......m./.s.e.k.....{.0.}./.t.....{.0.}./...r...{.0.}. .f.e.t...{.0.}. .s.m.l...{.0.}. .e.k.....{.0.}. .k.t.....{.0.}. .l...x...{.0.}. .m.s.k...{.0.}. .m.......{.0.}. .s.n.....{.0.}. .t.s.k...{.0.}. .j...l...{.0.}. .l.j.....{.0.}. ...r.h...{.0.}./.f.e.t.....m.e.t.r.a.r...t.o.m.m.u.r.....t.o.m.m.u.r.....y.a.r.d.a.r.....y.a.r.d.a.r.....{.0.}. ...l.d...{.0.}./.t.o.m...{.0.}./...r.i...{.0.}. .s.t.i.g...{.0.}. .b...t.i...{.0.}. .m...n.....{.0.}. .m...n.....{.0.}. .f.e.t.....{.0.}. .v.i.k.a...B.N.A. .t.o.n.n...g.-.h.r.....u.n...n.a.n...s.e.k.....{.0.}. .L.s...l...{.0.}. .M.s...l...{.0.}. .R.s...l...{.0.}. .b.i.t.i...{.0.}. .m.b...r...{.0.}. ...n.s.a...h...f.u.....t.t...t.r.o.y.e.s.o.z...{.0.}. .e.k.r.a...{.0.}. .m...l.a...{.0.}. .v...t.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\jmc.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\ki.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\ko.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9156
                                                                                                                            Entropy (8bit):5.545391513355349
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:BpZWVBvLdJk6Q99qtlQ0eO+koRL7Bz3ylgr:BpZWVBjdJPQ9O29Kopdz3yWr
                                                                                                                            MD5:B135AA99FF00AC0A9A1C3CB98633898F
                                                                                                                            SHA1:05A0D200915B96FD99B0B25633960E0BBA7C7E2B
                                                                                                                            SHA-256:F27CD269E2365F699A9343C92F97726F0B2A40AC6C60EB201000BF2449FBD03E
                                                                                                                            SHA-512:7963A17BE946F2FC0C6EE49095DA9C74B2A6C3B8ABB1621B35F126DC0F49939F49F96E4A3D04374E354B291F6887AF7B7B918ED7A94EA5FACCE4E02D3C26B352
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .._...................._-...91ci......).....-.(...T.(...{.0.}.....{.0.}.....{.0.}.D...{.0.}.|...{.0.}.....{.0.}.....{.0.}.C...{.0.}.....{.0.}..!..{.0.}.4...{.0.}.....{.0.}.....{.0.}.......{.0.}.......{.0.}.P.....{.0.}.......{.0.}...D...{.0.}./.D...{.0.}./.....{.0.}./.|...{.0.}./.....{.0.}.|....{.0.}......{.0.}.......{.0.}.$....{.0.}.x.....{.0.}.t.4...{.0.}..4...{.0.}.....{.0.}..%...{.0.}.0.....{.0.}.......{.0.}.8.0...{.0.}.(....{.0.}...H...{.0.}......{.0.}...9...{.0.}.(.d...{.0.}...q...{.0.}.t....{.0.}.......{.0.}./.....{.0.}./.....{.0.}.H.P...{.0.}.......{.0.}.......{.0.}.D.....{.0.}.@....{.0.}.x.X...{.0.}.<....{.0.}.........{.0.}.N.."m...{.0.}...\.....{.0.}.|.\.....{.0.}.B.t.u...{.0.}.b.b.l...{.0.}.l.b.f...{.0.}...x.....{.0.}.|...H...{.0.}.........{.0.}...t.....{.0.}....|...{.0.}.......{.0.}...x....{.0.}...x....{.0.}.....t...{.0.}.".H.g...{.0.}./.......{.0.}...t....{.0.}.T.....{.0.}...t. ....... .{.0.}...... .{.0.}....... .{.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\kok.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.368272640304357
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ5Ell88W2lT+l2iAllfPn9n:Svf/88hlCl2iA/n9n
                                                                                                                            MD5:4EB54990F712FE7E3F2DA1088393C832
                                                                                                                            SHA1:2375FB6AA7696FB3019296E2DCD6F885AC52A804
                                                                                                                            SHA-256:B759FCCFDFA0644D5EC14A30A3DEE6C2A008DE94C804DF1EE7F0F1AAC84567C0
                                                                                                                            SHA-512:BDB640894EDCCBCC3A03B805DDF27074D70EB137C90EC8DF73D4D2CCD66D9B3BD68645FBCA891D9CCF5C188661068BE0FC16885177FDB060D541B4111D50DB49
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................91ci..........!................`...P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\lt.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):29800
                                                                                                                            Entropy (8bit):4.84026116737284
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:LAq61BTfImbTzBfYOGpnuXLWuTe1dWBM8oBQKEO87ykRsG:sN/fUpniTe1dWG8CQKEO4y0
                                                                                                                            MD5:46C050C3658896E74B8A60461C6438B0
                                                                                                                            SHA1:6773A3A0D860BACEC66E3E1C22007EAAC2C439FC
                                                                                                                            SHA-256:D02996547794E680462092430169F15B8B83E4DCB00A17734581F39048A872C9
                                                                                                                            SHA-512:F6690044DCA30353C784C0B778F1E00D4855911AF0473555C3D6BE0354177E7A8490A3F88862C68564E6433325B79CF0FE9699E278B1A096B9E24B6468664274
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..x....................xM...91ci..{.0.}. .P...{.0.}. .R...{.0.}. .`...{.0.}. .I.M...{.0.}. .A.G...{.0.}. .K.N...{.0.}. .A.V...{.0.}. .a.m.....{.0.}. .N.-.m...{.0.}. .o.m.o...{.0.}. .o.m.s...{.0.}./.m.y.....{.0.}. .m...n.....{.0.}. .s.a.v.....{.0.}. .a.k.r.....{.0.}. .v.a.l.....n.a.n.o.s.e.k.....{.0.}./.s.a.v.....{.0.}. .m.e.t.s...{.0.}./.m...n.....{.0.}. .a.k.r.o...{.0.}. .a.k.r.s...{.0.}. .b.i.t.o...{.0.}. .b.i.t.s...{.0.}. .o.m.a.i...{.0.}. .o.m.a.s...{.0.}. .p...d.a...{.0.}. .p...d.s...{.0.}. .r.y.t.s...{.0.}. .t.o.n.s...{.0.}. .v.a.t.o...{.0.}. .v.a.t.s...{.0.}. .a... .a.....{.0.}. .k.v... .m...{.0.}. .v... .a.....{.0.}. .m.e.t.a.i...{.0.}. .t.o.n.o.s...{.0.}. .a.k.r.a.i...{.0.}. .p...d.o.s...{.0.}. .m...n.u.o...{.0.}. .a.k.r.a.s...{.0.}. .a.m.~.i.s...{.0.}. .b.a.i.t.o...{.0.}. .b.a.i.t.s...{.0.}. .b.i.t.a.i...{.0.}. .b.i.t.a.s...{.0.}. .c.o.l.i.o...{.0.}. .c.o.l.i.s...{.0.}. .c.o.l.i.s...{.0.}. .d.i.e.n.s...{.0.}. .g.r.a.m.s...{.0.}. .h.e.r.c.o.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\luy.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\mfe.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\mg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.7614817407829997
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM5Ell66E7lwMixn:SvL/66g7ix
                                                                                                                            MD5:73C69C57B33AEF2C0727DFDA891B26D5
                                                                                                                            SHA1:FCBB492532E487DAF4DE8D4F8884925FF3B1412F
                                                                                                                            SHA-256:13AFEF8EFD97579CFB7C479EA1B5B71DCF90FE527F4F9E7EE78F5F7EF97ECAA9
                                                                                                                            SHA-512:DDB84814465EA9CD26C061E49D03779C7FC4B11C4E6B3466D8EA24614D7C838CA84E2D2B14312A4ABCB24C78AC973F1D589B4579099D55150C9A2989BF665020
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\mgh.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\ml.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18364
                                                                                                                            Entropy (8bit):5.295725885924158
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:IuxDceZIl7vU8jWYgyL+pL/BVeg1KcVzx0g9Tw2HFRTMwV8hyLrQG4H3LGjH+R2E:Iuxp/YgS0xfeV7qDPb4
                                                                                                                            MD5:095C02A340E27E028CF7A2ADDACF10B7
                                                                                                                            SHA1:E55181D9E0F75B6DDAD050E03E5838CE2D0EE391
                                                                                                                            SHA-256:ED1F67B22587A8083061BE79BABEDFE6E54F515189D8E80852D62AAA83F936F9
                                                                                                                            SHA-512:E556A4790F3AB02FCFA89839F6A507EDB84314148507D87FE652B9588044199D9262664DB8275BB919A63B44E8A2A2A8955F829B9C67FB1E3BB804AD0E6C6077
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .._...................._....91ci..5.>.0.....5.>.0.....{.0.}. .....{.0.}. .....{.0.}. .5...{.0.}...z...{.0.}.......{.0.}. .....{.0.}. .....{.0.}.*.....{.0.}.5.....{.0.}...8.F...{.0.}. .*.W...{.0.}. ...?...{.0.}. ...z...{.0.}...+.>...{.0.}. .......{.0.}./.......{.0.}.*.K.....{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .&.?...{.0.}. ...>...{.0.}. ...H...{.0.}. ./.>...{.0.}. .5.>...{.0.}. .9.F...{.0.}./.......{.0.}./.......{.0.}./.5.....{.0.}.+.>.....{.0.}.+.|.....{.0.}. .K.. ..{.0.}. .*.....{.0.}. .5.....{.0.}...?.....{.0.}.$.F.......H.}./.......{.0.}. .(.B.....{.0.}. ...H.....{.0.}. .....?...{.0.}. ...?.....{.0.}. ...@.....{.0.}. ...H.}...{.0.}. .2.?.....{.0.}. .5.>.0...{.0.}. .8.F.....{.0.}./.....?...{.0.}.....@.....{.0.}./...?.....{.0.}. .*.H.......$.A.....H.}...{.0.}. ...>.....{.0.}. ...B.....{.0.}. ...B.~...{.0.}. .*.K.....{.0.}. .+.>.....{.0.}. .+.|.....{.0.}. ...@.....{.0.}. ...@.....{.0.}. .5.>.....{.0.}. .5.>.....{.0.}. .5.>.....{.0.}. .9.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\mn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):11676
                                                                                                                            Entropy (8bit):5.557641880818722
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:SX1L61ITu9d8cO9fS0BdtvL+WaqraNbVK7au7xfbNbVMtIY5shF0MN3xMBQCrFO3:nnqZSXWxBwujlDOnXM41O4TmjLvHB
                                                                                                                            MD5:2758071178FF41F92D9245465A596645
                                                                                                                            SHA1:2321E5635A8C64C2F170306BEF489C03EE8319C8
                                                                                                                            SHA-256:DBB8BA891FCDCE92442F918140F986E6B6A7D97087BEDBB50778EF1A43A9E6A0
                                                                                                                            SHA-512:B448B399A1453359027577CE082C8EBB0F0CEDA1730363A8549D3158E50FD72D984A356C0DF46225C9568A824522BBEF0CC504E949A09B1F2A0CB00A95B3CF6F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................W.. .x......_..._.........x.....91ci....*.<...{.0.}. .0...{.0.}. .F...{.0.}./.F...{.0.}.......C. .E.M.<...F. .E.M.<.....<.5.B.@.......0.9.B...{.0.}. .3.@...{.0.}. ...3...{.0.}. .......{.0.}. ...8...{.0.}. .......{.0.}. .<.....{.0.}. .<.E...{.0.}. .A.=...{.0.}. .E.....{.0.}. .F.....{.0.}. .4.....{.0.}. .6.>...{.0.}. .:.6...{.0.}. .<.8...{.0.}. .D.B...{.0.}./.3.@...G.8.3.;.M.;...:...-.F.0.3...:.<./.F.0.3...{.0.}. .A.0.@...{.0.}. .6.8.;...{.0.}. .C.=.F...{.0.}.7.C.C.=...{.0.}. .<.8.....{.0.}. .c.<.....{.0.}. .E.M.<...{.0.}. .F.0.3...{.0.}./.8.=.G...{.0.}.......=...{.0.}. .:.@.F...{.0.}. .4./.E...{.0.}. .:...F...{.0.}. .:.@.B...{.0.}. .<.C.1...{.0.}. .?.=.B...{.0.}. .D.B.....{.0.}./.A.5.:...<.8.;.8.0.<.?...:.2...<.8.;.L...;.8.B.@./.:.<...<.8.;.8.A.5.:...{.0.}. ...4...@...{.0.}. .>.=.>.>...{.0.}. .:.<./.F...{.0.}. .E.C.2.L...{.0.}.#.<.0.@.4...{.0.}...<.=...4...{.0.}...@.=...4...{.0.}. ...A.5.:...{.0.}. .8.=.G.....{.0.}. .0.O.3.0...{.0.}. .8.=.G.....{.0.}. .<.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\nn_NO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/FMlln:SBtkJ1li6gml/K/n
                                                                                                                            MD5:C34486D88A5544F3392A4FB031ECA28C
                                                                                                                            SHA1:287AE38B9011FD9BF97FAC414B405F1748B748FB
                                                                                                                            SHA-256:F7835F43B81AF073E115DCDBDD71E6D274C476853FFE6BEFCFF4A6DD26E02CC6
                                                                                                                            SHA-512:DD334E26082CD5F5B9CF2DD581930DB2DCFC8AE136FEA02B0A7E8376BAA2C0582236086C7D973A84C14EB3F873C6F540E70FE65917D757C6FA630E56CD780C35
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\pt_CV.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):2.9909324233057175
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMI9lx/lTNZlR4:SvjB2
                                                                                                                            MD5:5E3E0A089D7BACD2F1AC2684EE9BEF02
                                                                                                                            SHA1:4BD888AE18FA11258D13F8FA615D8915777CA4EE
                                                                                                                            SHA-256:F963A5003BFC4BCF7A310C34BDADED866BFE24561FEF032E89FECAB13BC3FFBB
                                                                                                                            SHA-512:A65C63ADD4DB82803F2ACA5D2CA2EBDADD12FAFF258472D36B0F735617104C352FF28B49AFC19446FCAB396E1FEBDC9A08BD91D2EF43F96EE25658D3A216C4BF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\pt_MZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):2.9909324233057175
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMI9lx/lTNZlR4:SvjB2
                                                                                                                            MD5:5E3E0A089D7BACD2F1AC2684EE9BEF02
                                                                                                                            SHA1:4BD888AE18FA11258D13F8FA615D8915777CA4EE
                                                                                                                            SHA-256:F963A5003BFC4BCF7A310C34BDADED866BFE24561FEF032E89FECAB13BC3FFBB
                                                                                                                            SHA-512:A65C63ADD4DB82803F2ACA5D2CA2EBDADD12FAFF258472D36B0F735617104C352FF28B49AFC19446FCAB396E1FEBDC9A08BD91D2EF43F96EE25658D3A216C4BF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\pt_PT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4396
                                                                                                                            Entropy (8bit):5.349190956533119
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:d4M01bDvkzmlMwWADyqoAzrYavLcapS88NVyyecUvWr:dkbDvQvw9RYazcCbIr
                                                                                                                            MD5:E4219AF836A36899BFBA8B1631813406
                                                                                                                            SHA1:F075D64302327FC2BD662958761CEA35DF2C9D69
                                                                                                                            SHA-256:6FA1F6835FD4F23FC763CECB7CC857A2E1DBF84C1A0D03C6B7B89E2E48C18B9B
                                                                                                                            SHA-512:B86AA2133B72A72F7920198C5B0D6D2C65F28C271AF77785A38F1405444EECCA1922622C3B9E6C440B7016C0993B3B6FA86DD8367CDDE358288980C8D2345240
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................<.. ........C...C...............91ci..{.0.}. .c.s...{.0.}. .s.u.l...{.0.}. .c.h...m...{.0.}. .e.s.t.e...{.0.}. .c.h...v.....2...1...4.7...8.9...{.0.}. .O.e.s.t.e...{.0.}. .n.o.r.t.e...{.0.}. .c.h...v.e.n.a...{.0.}. .c.h...v.e.n.a.s...m.i.l.h.a.s./.g.a.l...o...m.i.l.h.a.s./.g.a.l. .i.m.p.....{.0.}. .e.l.e.t.r...o.-.v.o.l.t...{.0.}. .e.l.e.t.r...e.s.-.v.o.l.t.s...{.0.}. .c.h...v.e.n.a. .m...t.r.i.c.a...{.0.}. .o.n...a. .f.l.u.i.d.a. .i.m.p.....{.0.}. .c.h...v.e.n.a.s. .m...t.r.i.c.a.s...{.0.}. .o.n...a.s. .f.l.u.i.d.a.s. .i.m.p.....{.0.}. .m.i.l.i.m.o.l.e. .p.o.r. .l.i.t.r.o...{.0.}. .q.u.i.l...m.e.t.r.o. .q.u.a.d.r.a.d.o...{.0.}. .q.u.i.l...m.e.t.r.o.s. .q.u.a.d.r.a.d.o.s...{.0.}. .p.o.r. .q.u.i.l...m.e.t.r.o. .q.u.a.d.r.a.d.o...{.0.}. .m.e.t.r.o. .p.o.r. .s.e.g.u.n.d.o. .q.u.a.d.r.a.d.o...{.0.}. .m.e.t.r.o.s. .p.o.r. .s.e.g.u.n.d.o. .q.u.a.d.r.a.d.o.....5...:..8.8.8..5...:.,...(...5...:..........5...:..@.4.@..5...:.-...)...5...:...+.....5...:...|.}...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\pt_ST.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):2.9909324233057175
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMI9lx/lTNZlR4:SvjB2
                                                                                                                            MD5:5E3E0A089D7BACD2F1AC2684EE9BEF02
                                                                                                                            SHA1:4BD888AE18FA11258D13F8FA615D8915777CA4EE
                                                                                                                            SHA-256:F963A5003BFC4BCF7A310C34BDADED866BFE24561FEF032E89FECAB13BC3FFBB
                                                                                                                            SHA-512:A65C63ADD4DB82803F2ACA5D2CA2EBDADD12FAFF258472D36B0F735617104C352FF28B49AFC19446FCAB396E1FEBDC9A08BD91D2EF43F96EE25658D3A216C4BF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci............

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\rw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sah.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3560
                                                                                                                            Entropy (8bit):5.072081775060199
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:xT7S+Nkq+gm1gN0fMqkOomB/P0siDO8+9QDrcFQevWdiJPrdTUEdxpR/ajHVLGVX:p7S+NkqLm1gN0fMqkOomBnFiDO86QDrW
                                                                                                                            MD5:E8DF44D39650D3C4CE831FC53BD059F1
                                                                                                                            SHA1:20487F16071939861E7C2D88A09B3E7F06C61E5F
                                                                                                                            SHA-256:CC61D9B22630DADBE6299A43D8B23778175E60AFF1EF6066050EC656FFA51251
                                                                                                                            SHA-512:CD982FB6D96ACE087CDB1B7C8AE492826D32B187486475F92B1A214BDF324C5FECA54BBFA6220A484300F9382D9AD69A79616646A52656B424DDF41C0B270125
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................j.. .......r...r..........y...91ci..{.0.}.;...:...0.9.B...{.0.}. .K.9...{.0.}./.K.9...{.0.}. .......{.0.}. .4.6...{.0.}. .=....."...0.0.9.B...:.K.@... .!.....9.M.;.M.@...{.0.}. .<...=...{.0.}. .A.K.;...{.0.}./.:...=...{.0.}. .:.4.6...{.0.}. .3.0.0...{.0.}. .A...:...{.0.}. ...9.M...{.0.}./.<...=...{.0.}./.=.M.4...{.0.}./.A...:...{.0.}. .1.8.8.B...{.0.}. .=.M.4.....{.0.}. .G.0.0.A...K.9.3.0. .{.0.}...{.0.}. .<.8.8.;.M...{.0.}. .:.8.8.;.M...{.0.}. .1.0.0.9.B...{.0.}. .:...B./.G...A.K.;.3.0. .{.0.}...{.0.}. .:.0.@.0.0.B...{.0.}. .:.K.@.0.0.<...{.0.}. .....0.0.9.B...G.0.0.A.:.0. .{.0.}...{.0.}. .;.8.8.B.8.@.M...{.0.}. .<.8.M.B.M.@.M...{.0.}. .<...=.....B.M...{.0.}. .=.M.4.8.M.;.M...{.0.}. ...0.;.>.@.8.9...{.0.}. .3.5.:.B.0.0.@...{.0.}. .:.K.@.0.0.4.K.A...{.0.}. .:.8.;.>.1.8.8.B...{.0.}. .3.8.3.0.1.8.8.B...{.0.}. .<.5.3.0.1.8.8.B...{.0.}. .A...:.....=.4.M...{.0.}. .:.8.;.>.1.0.0.9.B...{.0.}. .<.5.3.0.1.0.0.9.B...{.0.}. .B.5.@.0.1.0.0.9.B...<...=.....B.M...M.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sbp.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sh.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):92
                                                                                                                            Entropy (8bit):2.763053661085392
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMl2lYlillDTc6lLMGa:SBtkJcklIilNI6Jfa
                                                                                                                            MD5:5F7A1ACDBA8273876C06946D52D7EF6A
                                                                                                                            SHA1:6838F6556B7CB39A28F2D6D10B227D3511089B1D
                                                                                                                            SHA-256:4968812F54EEB455A6F0BAA9FAA9A68B5B5F94860FE4766506D8D265E2DB6B9B
                                                                                                                            SHA-512:DAEEF53AD06B57CC089E2CC5E1B053183CABFFC3D90215BFE84BB610A0A39D2E64CF55277CA7D4933430C33807D893079A82D1795C0BC204B673A7B7C6BEBFDE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci..s.r._.L.a.t.n.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\shi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/66E7lyMC/n:SvV/66gdC/
                                                                                                                            MD5:6134F4CD4D6C15CE86537D2613927036
                                                                                                                            SHA1:59D53B482F70551D8DEA499A310E7DA230219A18
                                                                                                                            SHA-256:68F743AEC976A4117DCA15A76760CAC2F8580CEDFA64B9C7D523A8F7BC0FE081
                                                                                                                            SHA-512:AAB3C6A451737433D25E38D86D21F865D944541D8C3A1EA23D937AFB33C3A06C56A436AFA997D42343AAE8395607819A1A79F0FCB60A8017EE4C6E4C9A140172
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci......g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\shi_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):2.9794524468707886
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMXE/flflcUTNZlgY/:SvV/cMEY/
                                                                                                                            MD5:6A9273AF56E5D1F6F2D24203334DDF9B
                                                                                                                            SHA1:BD7CA1CB1BA90B6036803043B8E351E6EC499DA5
                                                                                                                            SHA-256:F1D94FCB430E36370FA030C9D9892214DCB624289BC5282D432BF2A49378A08C
                                                                                                                            SHA-512:066CC289321C632CA0657AAC15F9F0E121C506B3EBD752E19277A5087417430E3C40525E0B410B930EF3A238328906AA64BF2A53B0FEBB26724918333C500508
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.h....................h.....91ci..........g.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\shi_MA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.872172957387978
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlgelU8gl8l/csqtDelOph:SBtkJZlU8g8l/soleh
                                                                                                                            MD5:F1FD5E8EDA008BB8F7B9C82734D8B0BE
                                                                                                                            SHA1:44D4EBA762F1BF83C2EF92EDD8A91163CF6EAB37
                                                                                                                            SHA-256:8777C3E45987B50B72F43DA1331824D298934CF97877E1789E376A65A9C6FDAD
                                                                                                                            SHA-512:30530B5DE13DA12DE36ABC9376494F90F1C3FB7926B5A65DA2CD65DD865822043CB5E52844DDF1B022A4C6D3EF630D1CFB35D90672BC6292ACC25EF8ACB654A4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci..s.h.i._.T.f.n.g._.M.A.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\so.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):16752
                                                                                                                            Entropy (8bit):4.833541903803518
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:+GkljLQTCV7qfR8/bvIWWz/TIK9HrxD0fId2M4WQ3LTEFQMs9DbIfJekqkZMI2:YcR8zIBz/nHrxofIdJdOTHshrqkSH
                                                                                                                            MD5:9B8FD3379E3E120A72E01EFECF1643AC
                                                                                                                            SHA1:8FA10FC67BBF756984F98EAD2594A6F4004F933B
                                                                                                                            SHA-256:19ECB3C299829F1CD34E0D202B877C4D208B72531FD5A72D70A4D7FC09C5F484
                                                                                                                            SHA-512:70157A00B353248F0E615C7D489D738A1CC92031E595A8245B7B53747A71E3FB14D589C9BA0CAAD83CF84AD7D4C02702CB72933183B61DDE52A92B640EAE54AF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................L.. ..t.....T...T..........t....91ci..B.i.l...H.K.B...k.t.s...s.n.o...j.i.h.o...B.i.l.o...M.e.y.l...m.k.o.b...{.0.}. .q...I.n.j.i.s...o.h.m.i.s...{.0.}. .C...{.0.}.i.l...B.B.e.y.t...F.u.u.d.h...G.B.e.y.t...M.B.e.y.t...T.B.e.y.t...f.i.i.t.....i.n.j.i.....k.B.e.y.t...m.l.s.e.k...{.0.}. .h.b...{.0.}. .B.B...{.0.}. .C.Q...{.0.}. .K.T...{.0.}. .b.m...{.0.}. .b.s...{.0.}. .b.t...{.0.}. .b.w...{.0.}. .k.r...{.0.}. .m.y...{.0.}. .n.t...{.0.}. .o.w...{.0.}. .u.x.....m.i.t.i.r...{.0.}. .m.k...J.u.u.l.e.s...M.a.a.l.m.o...Y.a.a.r.d.i...i.n.j.i.s.....{.0.}./.b.w...{.0.}./.m.t...{.0.}./.o.w...{.0.}./.s.k...{.0.}.M./.K...{.0.}. .b.i.l...{.0.}. .s.c.d...{.0.}. .m.l.n...{.0.}. .t.a.n...{.0.}. .M.b.a...{.0.}. .b.i.j...{.0.}. .h.B.a...{.0.}. .k.B.a...{.0.}. .m.b.t...{.0.}. .m.y.....{.0.}. .n.m.y...{.0.}. .s.m.y...{.0.}. .b.b.m...{.0.}. .C.D.h...{.0.}. .H.k.b...{.0.}. .K.W.s...{.0.}. .d.i.g...{.0.}. .m./.i...{.0.}. .m.y.....{.0.}. .s.n.d...B.a.r.s.e.k.s...a.m.b.e.r.e.s...m.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_BA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.905547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/csc6lSU5YMLn:SBtkJYlU8g8l/a6/5YMLn
                                                                                                                            MD5:331666E059510303EA5E9BD22324ACBC
                                                                                                                            SHA1:8CC2ECEEB94BFD3EF2F5B6DB21FE0CA71B06987B
                                                                                                                            SHA-256:38E6A6432D4E199AEDE8FA04AC7A448F95749F0E8EC3889E8BFA8D7D470D25CE
                                                                                                                            SHA-512:A99330F7DA649970C46F7A93F53D2FECA2D8C4EE9427E59058C4F02B591A84C6D1A3BCBF56BB0625145C38C7BC8FC390F766414F1DD38C30BFBB9A3DF77390AA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci..s.r._.C.y.r.l._.B.A...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_CS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9849392665878645
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMWlut6E7l+/DT4aN:Sv/ut6g+bUaN
                                                                                                                            MD5:88CA5D2B5F3BAA53F32D1A17AFFB3CC4
                                                                                                                            SHA1:B603EF247D2E23125E79C34F3695B44853A2024E
                                                                                                                            SHA-256:413C50EF83D5A3FF6C6F693E50594FF033A0301DCB807C2AD1EFDEB25FCB7642
                                                                                                                            SHA-512:BE26D85B7EA633275DE857127A7E8891FE0BD1EB66BA33E83EE6B652A76C0618BF052DA6A43FB9E21394941732D9805DC2FB801A5065B7EE8CDA6EA77FF3914D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..(....................(....91ci.......(

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_Cyrl_BA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/FMlln:SBtkJ1li6gml/K/n
                                                                                                                            MD5:C34486D88A5544F3392A4FB031ECA28C
                                                                                                                            SHA1:287AE38B9011FD9BF97FAC414B405F1748B748FB
                                                                                                                            SHA-256:F7835F43B81AF073E115DCDBDD71E6D274C476853FFE6BEFCFF4A6DD26E02CC6
                                                                                                                            SHA-512:DD334E26082CD5F5B9CF2DD581930DB2DCFC8AE136FEA02B0A7E8376BAA2C0582236086C7D973A84C14EB3F873C6F540E70FE65917D757C6FA630E56CD780C35
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_Cyrl_RS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/FMlln:SBtkJ1li6gml/K/n
                                                                                                                            MD5:C34486D88A5544F3392A4FB031ECA28C
                                                                                                                            SHA1:287AE38B9011FD9BF97FAC414B405F1748B748FB
                                                                                                                            SHA-256:F7835F43B81AF073E115DCDBDD71E6D274C476853FFE6BEFCFF4A6DD26E02CC6
                                                                                                                            SHA-512:DD334E26082CD5F5B9CF2DD581930DB2DCFC8AE136FEA02B0A7E8376BAA2C0582236086C7D973A84C14EB3F873C6F540E70FE65917D757C6FA630E56CD780C35
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_Cyrl_YU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9849392665878645
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMWlut6E7l+/DT4aN:Sv/ut6g+bUaN
                                                                                                                            MD5:88CA5D2B5F3BAA53F32D1A17AFFB3CC4
                                                                                                                            SHA1:B603EF247D2E23125E79C34F3695B44853A2024E
                                                                                                                            SHA-256:413C50EF83D5A3FF6C6F693E50594FF033A0301DCB807C2AD1EFDEB25FCB7642
                                                                                                                            SHA-512:BE26D85B7EA633275DE857127A7E8891FE0BD1EB66BA33E83EE6B652A76C0618BF052DA6A43FB9E21394941732D9805DC2FB801A5065B7EE8CDA6EA77FF3914D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..(....................(....91ci.......(

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_Latn_CS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9849392665878645
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM10t6E7lHbT4d:SvZt6g7Ud
                                                                                                                            MD5:3A213577811436F09FF24D0DF8D5BB64
                                                                                                                            SHA1:412A7D31D9BF049CDF57CC29CBBB81B73BC856BD
                                                                                                                            SHA-256:F290EA9AE14EA99460199281AEE05EDB1532D2C47715999D01C1F6A4B91FE976
                                                                                                                            SHA-512:1E10DE89F72496207ACAFF7BCB79342E5AC41BE27CAF134EE07C36768D3086C2B8A80B49E3D77F37069F378C9B86EE18511357D61B643C2CFFF631556FA2F2AA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.Z)...................Z)....91ci......Y)

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_Latn_ME.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/FMlln:SBtkJ1li6gml/K/n
                                                                                                                            MD5:C34486D88A5544F3392A4FB031ECA28C
                                                                                                                            SHA1:287AE38B9011FD9BF97FAC414B405F1748B748FB
                                                                                                                            SHA-256:F7835F43B81AF073E115DCDBDD71E6D274C476853FFE6BEFCFF4A6DD26E02CC6
                                                                                                                            SHA-512:DD334E26082CD5F5B9CF2DD581930DB2DCFC8AE136FEA02B0A7E8376BAA2C0582236086C7D973A84C14EB3F873C6F540E70FE65917D757C6FA630E56CD780C35
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_Latn_RS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/FMlln:SBtkJ1li6gml/K/n
                                                                                                                            MD5:C34486D88A5544F3392A4FB031ECA28C
                                                                                                                            SHA1:287AE38B9011FD9BF97FAC414B405F1748B748FB
                                                                                                                            SHA-256:F7835F43B81AF073E115DCDBDD71E6D274C476853FFE6BEFCFF4A6DD26E02CC6
                                                                                                                            SHA-512:DD334E26082CD5F5B9CF2DD581930DB2DCFC8AE136FEA02B0A7E8376BAA2C0582236086C7D973A84C14EB3F873C6F540E70FE65917D757C6FA630E56CD780C35
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\sr_RS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9849392665878645
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMWlut6E7l+/DT4aN:Sv/ut6g+bUaN
                                                                                                                            MD5:88CA5D2B5F3BAA53F32D1A17AFFB3CC4
                                                                                                                            SHA1:B603EF247D2E23125E79C34F3695B44853A2024E
                                                                                                                            SHA-256:413C50EF83D5A3FF6C6F693E50594FF033A0301DCB807C2AD1EFDEB25FCB7642
                                                                                                                            SHA-512:BE26D85B7EA633275DE857127A7E8891FE0BD1EB66BA33E83EE6B652A76C0618BF052DA6A43FB9E21394941732D9805DC2FB801A5065B7EE8CDA6EA77FF3914D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..(....................(....91ci.......(

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\te.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22536
                                                                                                                            Entropy (8bit):5.055542219826834
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:5use72HkP0HnjmfIusADne/tdhaQAbyB98qQfig71nl8uLT6qw6RGnEfhHQxE2iP:5WQRm8Bi71nlX6qw6OAZQxE2i3g3N4Jf
                                                                                                                            MD5:248A72F139BFD13159187A0011FA2B6D
                                                                                                                            SHA1:E0CE0321DDF5B1794C156B4EDAA797B70B99F455
                                                                                                                            SHA-256:9AC800439CB6D05264C533353F40993335476FA7CB65BF832EC877009E108E14
                                                                                                                            SHA-512:38B4A1953ABEEC4DCF7A5CC1E604FAF637B4A0A092F19A95179C90D9D2C9ED2BFEF0A15B8F460D5E69CEA697E9E4D17FC8CC9D125451B8B902CE30B19F78E1EE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .._...................._M...91ci..(.?...?...{.0.}.5.>...{.0.}.8.F...{.0.}. .....{.0.}. .6...{.0.}.......{.0.}.(.?...{.0.}.(.F...{.0.}...@...{.0.}.0.K...{.0.}.2.@...{.0.}.8.....!.?...+.>...{.0.}. ...F...{.0.}. .......{.0.}. .......{.0.}. ...A...{.0.}...+.>...{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .&.....{.0.}. .*.....{.0.}. .,.?...{.0.}. .,.H...{.0.}. ...H...{.0.}. .2.....{.0.}. .5.K...{.0.}./.......{.0.}./.......{.0.}./.0.K...{.0.}./.8.F.......>.2.A.........>.2.A.....(.>...8.F.......?...8.F.......H...8.F.....{.0.}. .5.>.....{.0.}. ...G.....{.0.}. ...H.....{.0.}. .........{.0.}. .*.L.....{.0.}. ...@.....{.0.}. .9.F.....{.0.}. .........{.0.}. .(.>.....{.0.}. .........{.0.}. .........{.0.}. .........{.0.}. ...L.....{.0.}. .!.?.....{.0.}. .$.B.....{.0.}. .(.F.....{.0.}. ...@.....{.0.}. ...@.....{.0.}. ...H.....{.0.}. ...H.....{.0.}. .0.G.....{.0.}. .2.@.....{.0.}. .8.......{.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\tg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.368272640304357
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQVl/88WDlNT+l2iAllfPtk9n:Sv+C8SNCl2iA/tcn
                                                                                                                            MD5:F18F6D8DC0E40E96A1B5058D53270004
                                                                                                                            SHA1:696FE9BD9343B7BBE26041326571C2C99CC485DB
                                                                                                                            SHA-256:118D6F6CDD6912A4366B5C6478DFD735D606CB7210157AF2A8904B44297CE0D4
                                                                                                                            SHA-512:8DAEA2D8173E64A903B0CE89672E81F28A34DB824B8A2C07B6AC3DC380187F318E1F49FED00875DF6F41491756E4DEB664529B9D2354E467401D59D9215161E7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .*!...................*!....91ci..........!.............)!.`...P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\th.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14192
                                                                                                                            Entropy (8bit):5.162604351879862
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:JjuBknvo7nMjqA6QMg+UXJcdrPXgnqNX+M1:J2kvo7M7M7UZc5yq51
                                                                                                                            MD5:C88DF0C69931B5DF6FC00A9C6652917D
                                                                                                                            SHA1:D2AF577CB36AC0F180C018DD458D9B4918254A6E
                                                                                                                            SHA-256:9EA2245F37F6DAAF5BBE5BCF4FDEA870CEDFED366A7E0212D3CCEAD7B569F9C8
                                                                                                                            SHA-512:FE1F0DB9A575FA02FF31E9CB5F1D3DE8DD8036452DC740C2D9F874B072CD4A7A7C6632F7749BC446629CB2BB19C85397AC43D6BDDA0F6F08498AAEDF2DF508F8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .._...................._5...91ci....4.(...{.0.}.....{.0.}. .....{.0.}.'.4...{.0.}. .....{.0.}.......{.0.}...5...{.0.}.!.....{.0.}.%.....{.0.}.........{.0.}...!.....{.0.}...!.....{.0.}.!.!.....{.0.}. .......{.0.}. ...-...{.0.}. ...5...{.0.}. .......{.0.}. .......{.0.}. .......{.0.}. .!.....{.0.}. .%.....{.0.}. .'.4...{.0.}./.......{.0.}./...5...{.0.}./.!.....{.0.}./.%.....{.0.}./.'.4...{.0.}...!.....{.0.}.'.1.....{.0.}.+.%.2...{.0.}.C...I.....5...5.".9...{.0.}. ...8.....{.0.}. ...-.....{.0.}. .#.-.....{.0.}. ...9.%...{.0.}. ...1.....{.0.}. ...4.....{.0.}. ...8.....{.0.}. .'.1.....{.0.}. .+.%.2...{.0.}. .B.!.%...{.0.}...2...5...{.0.}. .........{.0.}. ...'.....{.0.}. .........{.0.}. ...%.....{.0.}. ...!.....{.0.}. .!.......{.0.}. .!.%.....{.0.}. ...%.....{.0.}. .........{.0.}. ...!.....{.0.}. ...!.....{.0.}. ...!.....{.0.}. ...%.....{.0.}. .!.!.....{.0.}./.........{.0.}./...!.....{.0.}./...!.....{.0.}./...!.....{.0.}./...8.....{.0.}./.'.1.....{.0.}.D.!.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\th_TH_TRADITIONAL.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):2.9886793699589003
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtldelFal9lUfsqJ/qcs8Vn:SBtkJUlY05Zn
                                                                                                                            MD5:E72557576FFE1CD5460C3497156F022C
                                                                                                                            SHA1:AE59392718061FC184F7C4C6FFA937FD08C153D3
                                                                                                                            SHA-256:4AD5CFD24AB4748C4D5B25F88C66390A41B36BE6BA4932EC6B689A47D4DDEC21
                                                                                                                            SHA-512:D55B9F4FBF0A289C0133CBA35C6AF52DB40804745FBC9EED2732634B9170055ADE0ACA225FEC8CEA1AFEB4D88CF7E1E01F44D21D8922874B69D885DD2DFE8F49
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................91ci..b.u.d.d.h.i.s.t..................P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\tl_PH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):92
                                                                                                                            Entropy (8bit):2.7982394370785384
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlF112lYlillDTh91Zn:SBtkJclIilN99jn
                                                                                                                            MD5:29D434DFCCA238F4E7B71194CD306D84
                                                                                                                            SHA1:D485D726A3FEFA62E0A7EB9E6C40421BC1D26740
                                                                                                                            SHA-256:2A4A3574497EC48D395B4FCAE86D9572984D32DD88D3B44613B66983777EBC79
                                                                                                                            SHA-512:F9D05DCC5A8B10EA253C9708958A3AA0BAE9BD4979513904C4B7E5694210744BED223937A24EC0BEB9CE6215C2A798470A6DBEFB44ECA82C79C8D0E11557CE3B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci..f.i.l._.P.H...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\uk.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):30452
                                                                                                                            Entropy (8bit):5.158024533586776
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:9DuH0mg+Ez8uAJ0f+3Dt8gcC0AP5hJhUNoFFj6tt8PxO3P50NcfsGQgzHttPHIhV:9vzqPIXC83x0NZGtzPHISl8
                                                                                                                            MD5:D0AB00A38F64576C2236C5EE6A61153C
                                                                                                                            SHA1:D4D12349E97E235A9B6B3ABC43A6EAFC5A4FB4DE
                                                                                                                            SHA-256:7E46B5D874788E7CF483A209DADEE21442DBE01717FC2B3C08DE1C93AACB1C2F
                                                                                                                            SHA-512:76BD20F7ABD0EE04AE783720F5E595D1B4167EFC6D7D8D8405DDA53BCAC1496C9613D8EF31D5A9409FF372CC84030E2E4E9B1F3DCF82EA4FF1EB5680843BDD62
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .x....................x.....91ci..{.0.}.B...{.0.}.......1.V.B.....1.V.B...".1.V.B...:.1.V.B...<.8./.3...{.0.}.4.<...{.0.}.=.<...{.0.}.=.A...{.0.}.?.B...{.0.}...0...{.0.}.5.....{.0.}.<.3...{.0.}. .1...{.0.}.?.:...{.0.}./.@...{.0.}./.B...{.0.}. .@.....{.0.}. .E.2...{.0.}.<.:.<...{.0.}.<.:.3...{.0.}.....<...{.0.}...B.1...{.0.}.A.B.....{.0.}. .>.1...{.0.}. .5.....{.0.}.1.C.H...{.0.}./.E.2...g.-.A.8.;.0...{.0.}. ...E...{.0.}. ...4...{.0.}. ...=...{.0.}. .!.E...{.0.}./.@.....=.0.?.@.O.<...{.0.}. .4.=.....{.0.}.<.>.;.L...{.0.}.1.0.@.....{.0.}.<./.A.....{.0.}.<.<.@.A...{.0.}.D.=.B.A...{.0.}. .....<...{.0.}. ...B.1...{.0.}. .1.C.H...{.0.}. .A.B.....{.0.}.4.C.=.....{.0.}. .4.=.V...{.0.}. .>.<.8...{.0.}./.D.=.B...{.0.}. .1.V.B...{.0.}. .4.=.O...{.0.}. .@.V.:...{.0.}./.3.>.4...{.0.}./.4.=.....<.5.B.@.8./.A...{.0.}. .<.V.A.....{.0.}. .B.8.6.....{.0.}. .<.8.;.V...{.0.}.B.@... .C...{.0.}. ...:.0.;...{.0.}. .1.0.@.....{.0.}. .3.0.;.....{.0.}. .:...A.....{.0.}. .<.V.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\uz_Arab_AF.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/FMlln:SBtkJ1li6gml/K/n
                                                                                                                            MD5:C34486D88A5544F3392A4FB031ECA28C
                                                                                                                            SHA1:287AE38B9011FD9BF97FAC414B405F1748B748FB
                                                                                                                            SHA-256:F7835F43B81AF073E115DCDBDD71E6D274C476853FFE6BEFCFF4A6DD26E02CC6
                                                                                                                            SHA-512:DD334E26082CD5F5B9CF2DD581930DB2DCFC8AE136FEA02B0A7E8376BAA2C0582236086C7D973A84C14EB3F873C6F540E70FE65917D757C6FA630E56CD780C35
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\uz_Latn_UZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/FMlln:SBtkJ1li6gml/K/n
                                                                                                                            MD5:C34486D88A5544F3392A4FB031ECA28C
                                                                                                                            SHA1:287AE38B9011FD9BF97FAC414B405F1748B748FB
                                                                                                                            SHA-256:F7835F43B81AF073E115DCDBDD71E6D274C476853FFE6BEFCFF4A6DD26E02CC6
                                                                                                                            SHA-512:DD334E26082CD5F5B9CF2DD581930DB2DCFC8AE136FEA02B0A7E8376BAA2C0582236086C7D973A84C14EB3F873C6F540E70FE65917D757C6FA630E56CD780C35
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\uz_UZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.965547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/csllwl3l/Ln:SBtkJYlU8g8l/fK/Ln
                                                                                                                            MD5:92C8207FC061004A9199AEB7B897CA30
                                                                                                                            SHA1:3057478FFA023C34B6B8F8E32ABA2EB90A685C6A
                                                                                                                            SHA-256:98E38696C8243B84CAD71E47F1077B1D7B5DC54B9BCF501BFB965CC9CFAA36EF
                                                                                                                            SHA-512:362FC0A5FF0B6DAECA3A575AAA1908ADF996C66FFA94832C5A30C26E9F7BC69F7772468ECDC580E416087C9B667E7B91B33CB9BE6B90789127207DF0C5D444A7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci..u.z._.L.a.t.n._.U.Z...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\wae.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):508
                                                                                                                            Entropy (8bit):4.127084859354323
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:sG0sNYkc+R+/HtFY89LDKlcLsnPGcjzjd:6sNYkc++vtFY2LNLavh
                                                                                                                            MD5:592C3FD4F74A53D6D35227FC302C57C3
                                                                                                                            SHA1:3C3D80ECED0C41EFE1C92F7B947EA2FE48D3B66E
                                                                                                                            SHA-256:37DC93529EDFDCC38D62AEACDE411F88AA08BF374D1D37EF7B4AD946208F71A1
                                                                                                                            SHA-512:0BA17B0EDC3E74D2CF0ED5D8C53834AFCD06EECC78CE231F40C9422534A635F2529F04F3E6AFE7786B11940B04C6DC1A162C39025A65883F9480510DE895C6A6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................r.. .F......w...w.........F.X...91ci..{.0.}. .j...r...{.0.}. .t...g...{.0.}. .w.u.......{.0.}. .w.u...a...{.0.}. .m...n.e.t...{.0.}. .s.t.u.n.d...{.0.}. .m.i.n...t.e...{.0.}. .s.t.u.n.d.e...{.0.}. .m.i.n...t.a.....5...:.S.O.O...5...:...s.....5...:.....}...5...:.m.i.i...5...:.E..'.4..5...:.[.`.W...5...:.K.G.G...5.S...5.....5.....5.m...5.E...5.[...5.K...[...c.w.d...c.X..P_..Pf..Pm..Pt..P{..P...P..J.X.. ..[...c.w.d...c....P...P...P...P...P...P...P..J.e.. ......m.g..`c.. p..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\xh.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):96
                                                                                                                            Entropy (8bit):2.6065957221707605
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlu112lFvlslpl9lUfsBOlhFc/u+ln:SBtkJK0lslL0AOlg3l
                                                                                                                            MD5:984B9A1F11CC36ECCE851C57010A572C
                                                                                                                            SHA1:DDE4651D99AF095C01CE7A1A2F5E5572C32F8A41
                                                                                                                            SHA-256:BD47EF872F6A9D88B7304311170B8C524C2FB432ECCF8D6A4CEB03AD61AE6A58
                                                                                                                            SHA-512:236AE3FA7F2150AA020F5D2864147F565894EDC926DCDC0503CA1AA0B5B24A49D3B41E2DC2D2A211261458DC5D5BFD9DAD7BA9BA1D00353A29D646FCDF0FDE9F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci..2...1...4.8...8.9.........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\yi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.4007237652827222
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQXE/88WC+l2iAllfP1lv:SvB/88gl2iA/19
                                                                                                                            MD5:53685FAAB150D418AFCAA1DF89946567
                                                                                                                            SHA1:D6EFB81F7AC56A634B23A850E335A5F2CC2B0EC2
                                                                                                                            SHA-256:2D86B12E755A34C120C4173143AAF22F39D95CA59E979AAA465034C3E3F895DE
                                                                                                                            SHA-512:52AFDDEA08A555688ECDFB310EADC6B48CAC0BF12B94ACD74B64F4CCC4F17CE66393B8B87854F2FC48147AC9E24FE527E9B37CDD56B4F17F33BA80523ABDB453
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .h....................h.....91ci..........!.............g..`...P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\yue_Hant_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/FMlln:SBtkJ1li6gml/K/n
                                                                                                                            MD5:C34486D88A5544F3392A4FB031ECA28C
                                                                                                                            SHA1:287AE38B9011FD9BF97FAC414B405F1748B748FB
                                                                                                                            SHA-256:F7835F43B81AF073E115DCDBDD71E6D274C476853FFE6BEFCFF4A6DD26E02CC6
                                                                                                                            SHA-512:DD334E26082CD5F5B9CF2DD581930DB2DCFC8AE136FEA02B0A7E8376BAA2C0582236086C7D973A84C14EB3F873C6F540E70FE65917D757C6FA630E56CD780C35
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\zh_CN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.945547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/csfJRzlI/kmn:SBtkJYlU8g8l/FJFGkmn
                                                                                                                            MD5:AEB320D4912F54EF1312147C4488DBB9
                                                                                                                            SHA1:1178FE7F00D59FC7F4EB51979DB5E12D6BD0B0B6
                                                                                                                            SHA-256:84FFA987E78CA5B8CE583956F30ACC050F93D73A9E75695D1DD93C1EEAA7DBEB
                                                                                                                            SHA-512:F3859842E63CB3D6AA9892898713E343079754C6896FD3738EF62826C7F3AC4D9FC1FA004AD9912F65FEA4587414BDDCDFD86712EC358A0DB76D748D8C1947F7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci..z.h._.H.a.n.s._.C.N...........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\zh_Hans.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMI06E7lwlfMW/n:Svj06gwiW/
                                                                                                                            MD5:85A6974221A7807B04C9E016B6C8904C
                                                                                                                            SHA1:421C17E072A104975C29E5C4A51575C5A9542489
                                                                                                                            SHA-256:939C1DA1C4ED3E97227CFC94D46BACDFBBB8D2BFF721EC42618B641DB731AD3D
                                                                                                                            SHA-512:EADBC62801B0D5ABA4B9A2BBDF469F007493FE613E04B640AA511383A4E3D707AC0ADCFF3E5D80F1598090E12CD65C5985DFCDF0CF8D46AF807BAD00204182CC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................91ci........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\zh_Hans_MO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):172
                                                                                                                            Entropy (8bit):3.7784798679943252
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tl9e8Crlas08lLQHptizlu7giN/+k/Fshgp9kD//UlAjW/lKxfn:Svc8CrqqQJEz8xtNT0//UijWAxf
                                                                                                                            MD5:9D9B9C544D250F573B187FA20A37FAB6
                                                                                                                            SHA1:16C2B4227D4A969E336292B2A9C3A23A51BD9505
                                                                                                                            SHA-256:8423C2E865B10BB622270AB95F80F6F2D34FF4B4F3F828B0EEA928EB8757CE47
                                                                                                                            SHA-512:2928C40A6F35EE175EADBB4B96DD26965DC7C23243740DD4A96E0679DD4D9586549625405265B4CCF6B80FE575B6DDC46B4ADB53A181B1173C3DBA52F7493F39
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........#...#...............91ci......3...:.....5.:.......:.......d....P..D....P....J......P... ... ..D....P....... ......m....`... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ur_PK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\uts46.nrm

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):58416
                                                                                                                            Entropy (8bit):5.816633436992908
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:+RaWSN/Ixeb7VZNw5/sWK7O+HQe9l3YFFonJ0QhPxjK+Kv2:CMfVZa0Oyl3hnhPxu72
                                                                                                                            MD5:DEDDFC6884799EFF970AD3809557DCC8
                                                                                                                            SHA1:E27755C52CD11323FC90AD094428904128B4CC72
                                                                                                                            SHA-256:75BF5DDADF3423305C40C67E09E8A38F1A10A912F9810D041966D8A86DB29BCB
                                                                                                                            SHA-512:A6ADFAA68355F35A699A274D155E876D754F57DEB5D3D3EAB31263D44ECC299FECA491C44C85E0D2FB4F756112111BD71563C22F5B1BB24ACA29CDE303BF6067
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........Nrm2................P...............................A...A.......P...vS......`...tJ...R..rS..........3irT.....<..[.....@.......?.......;.i.....".b.....!._.......C.........n.......-.k.......T.......K.......E.......A.~.....5.t.....3.r.....1.n.....,...g.......7.t....... .O.t.............................V.......L...l.......\.........[.......G.........C.......<.|.....<.|.....<.{.....;.{.....+.j.............9.y.............................................-.:...q.............K.g...... 0 ..p . . .!P!.!.!."P".".".#N#.#.#.$N$.$.$.%N%.%.%........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\uz_Arab_AF.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):92
                                                                                                                            Entropy (8bit):3.3283646412792995
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tluF3lElwqllERnySPikv:Sv6VMwfBySdv
                                                                                                                            MD5:7501CC41631B81BC6FA175B8963ACD70
                                                                                                                            SHA1:B04D289CE28F1842249549D378530F49C8765DC6
                                                                                                                            SHA-256:3B3D70E6FAC4E5CD85444CED64A6DD3A5C73680734524EB30B3C159C063DC389
                                                                                                                            SHA-512:1778AA289D567BDABA783CD651FC6A34E75E7F2F04BA28737EF3829574CCDC37D8811C602F1737E7DDAABE67CF305975B79B85E8146842CFA6E7C3E0303AA266
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...................................t.....o.w......`...P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\uz_Latn_UZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMxEllut6E7lfEKU:SvMM0t6g8KU
                                                                                                                            MD5:F637999C3373220F35094AB85161AFBB
                                                                                                                            SHA1:24891E13D210B7E6B7D0053CBF5A945566F79938
                                                                                                                            SHA-256:EB0040ACAD7DE2A57E33A3AD90FB1711651A7FF071D21653A3B6BC7AA39CEC7B
                                                                                                                            SHA-512:D7B2CD72563F0A9015A2D3239D4660A3086262F633B680128B0B6F86C3AB8051838858133488768D9BD0D1DB97F64C4B61172A7F6F7556C8D2295DB48673708F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\vai_Vaii_LR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\vun.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):920
                                                                                                                            Entropy (8bit):5.773106278693203
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:DMzq6TvMx06TvMsEAgbcusZhC//ooRQQXswrVorA8cs:ejMxrjMsvgb+C/o3QXhYATs
                                                                                                                            MD5:CAE16B5CBD28771099A3AA4BEE4BFF22
                                                                                                                            SHA1:B692625C2D3A2AFE65519F57B20235E7321AB332
                                                                                                                            SHA-256:199DA3398504CE87F971816F6F67D7505D7BE136BED8B5690E4E6845EF2CA3D6
                                                                                                                            SHA-512:D2CB5ABE1E38E121A66220A29DCEC48CCF52D068A2FB59FD85225EBC0158D51004DF99BFC8DECF530FCB8DBB4BE297E9687A7509C6083871C44C8C17A1727083
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................................I.n.u........)..k..)...4.wEy..................................!.$...0.............'./..4....eN>...D....L...3..].N..).P.M.N........."....."..k..)...4.wW*eh................................!.$...0.............'./..4....eN>...D....L...3..].N..).P.M.N..............u......."","B...........G.G.G.G.D.q.G.....|....mMm..=.1...M.e.E.A...I.).9.}...........e.w...............G.A..4D..4G.G.D.>.J.../.......................h.~.................H...@.........E............................5k....4............7.......P....... ...............P................................... ... ................................................... ... ....................... ..j.v.......".H.S...A...D...G...U..P... ... ... ... ....`...... ... ...........`...P......:.l..... ...a........ ...P...P...P...P...P...P...P...P...P......C...o.w.]........`...`...`... ...`... ...P...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\vun_TZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\xh_ZA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMrEl0t6E7lZEKd4:SveM0t6gWK6
                                                                                                                            MD5:8E658E24E91577B14FB18BDC90A2E1C5
                                                                                                                            SHA1:2A12C0DF79A4B42F048C50BA66C942AAC4A256E8
                                                                                                                            SHA-256:829E57B045199BA2D82B08BAAE8107B9875C7A99488FF32E7C3E225EA16A8A67
                                                                                                                            SHA-512:EEED6686C5CA622DBEB27D18AC89606D55F759C8F450860ADC1D5AA956ABA14F5606AAEE7A173846E947B7274F6BE9CA039BF0838FEA8D1FAE08D2B6B0B386C3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P...................................o...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\yi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4032
                                                                                                                            Entropy (8bit):5.607182675392539
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:kPkUdmvpI+tIJhIIhsBy8+VvbH7cpIIcLHB9m2Sj:k4dEhIMI+VvbH7cfcLHBfs
                                                                                                                            MD5:C180EE0ABDE3EF986D6725617A964F34
                                                                                                                            SHA1:189E8D526AC80FF06E3C74AB1987D92C4E36F3F9
                                                                                                                            SHA-256:E59900C74EE25A80F80B7F2856B32E43F38F0F4FE61F0934FFDFB13E63E14D39
                                                                                                                            SHA-512:C7D4A98C3ECF00B1805A69C1251BA72AEB0DF4CBCAE0963C84804118E019452F002DD68A8825132C8B52A6AA326C52F2B5DB929F78B3F69F3174DD9FC3518FF7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .5....................5..................2...............................................................................................................................................h.e.b.r.......................................................................................................[.. . ]............................................................................................................................................................. ............. ............................................................................................................................................................................................................................. ................. .........................................................................................E. ....... .d...................................................................................................{.0.}. ....... .{.1.}...d..... .M.M.M. .y. .G...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\yo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4032
                                                                                                                            Entropy (8bit):5.659362106790011
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:sBo+CFVSv3Hf8FWUIHk2bM9cu7Cbkzb0ykk+pFh3F:sBnaVSv3Hf8FrIHk2bM9cu7CYzc3F
                                                                                                                            MD5:71A05EBDE9FF4F9BFCF078EA6D007FEA
                                                                                                                            SHA1:66F83EE8D96984E57C2BD526EAF27B39D283AD1B
                                                                                                                            SHA-256:112975EE37E74F1C41CB05D1B5EB8400EEC4BA5364E28E2BE07430675C349EE9
                                                                                                                            SHA-512:7CBF0E7DB845F7EFBEE2F8C994522090C9F01B684C4EC214C7F735E7BD627A419A64F3EB47891F598F3C91244BAD91557E224F62247E8DA0AF027D75EC6CD54A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .A..............-.....A........................................A.j.....t.........A.g...B.....K.e...O.w...k.......r.....g.....g.....k.....r...O.s.......n.......n.....H.:.m.......k...A.g.....B...l...K...r...K...t...O.w.e.....g.b.....g.......k.....b...........b.......p.......w.....d...n.....j...........l.a.....b...m...K...i.n.....r...l.....g.b.....b.....r.......b.i.......p.........w.........r...........s...n.......s.......H.:.m.:.s.....s.....g.....j.....b.....j.....r.....j...t.a.....r.....n.....j.....b.......j.....r.....W...k...t.......s.....j.....d. .M.M. .y...o.c... .y.........t.....n.l.a.....j..... .A.j.......j..... ...t.....O.c... .B...l.....O.c... ...g.b.....O.c... ...g...n.....j..... .....k.....O.c... .A.g...m.....O.c... .O.w.e.w.e...O.c... ...r...l.....O.c... ...k...d.u...O.c... .....p...........s..... .y...........d...n. .y.........d... .m.....r.i.n...O.c... .b.....r.......O.c... ...r.....n.....O.c... .....b.i.b.i...O.c... .....w...r.....M.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\yo_BJ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4104
                                                                                                                            Entropy (8bit):5.602271383533896
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:wiOtFIxmiQWKpVH7XVSRerbMmgxmQhxxymTmFi:LOtFomRhpVTURSQJx7xxJ
                                                                                                                            MD5:8E47DD79C2A4902D3930DC926A72C4ED
                                                                                                                            SHA1:4BBFAA0586B10D12F86F2AD49B73768D7B733681
                                                                                                                            SHA-256:4F8716C2397705120536D220A3928B7D247596093E0EA78BFD75BA9A2CC908B6
                                                                                                                            SHA-512:6FDB3116278569AE835F5C6E9DB2993637536AD1F9E873294FF15D1AD2558DD7A0E134FF5E6A878D1406FC24398091BA87F84447ABA0E5BA90E889E590847F88
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .A..............-.....A........................................A.j.....t.........A.g...B.....K.e...O.w...k.......r.....g.....g.....k.....r...O.s.......n.......n.....H.:.m.......k...A.g.[...B...l...K.[.r...K.[.t...O.w.e.....g.b.....g.......k.........p.......w.......b.....d...n.....j.T.........l.a.....b...m...K.[.i.n...S.h.[.......r...l.....g.b.........p.[.......w.........b.i.......r.T.........s...n.......s.[.....H.:.m.:.s.....s.[...g.....j.T...b.....j.T...r...S.h.[...r.....j.[.t.a.....r.[...n.....j.T...b.T.....j.T...r.....W...k...t.......s.[...j.....d. .M.M. .y.....t.....n.l.a.....j.T... .A.j.......j.T... ...t.....o.s.h... .y.........j.T... .....k.....O.s.h... .B...l.....O.s.h... ...g.b.....O.s.h... ...g...n...T...s.[... .y.......T...d...n. .y.........d... .m.[...r.i.n...O.s.h... .A.g.[.m.T...O.s.h... .O.w.e.w.e...O.s.h... ...r...l.....O.s.h... ...k...d.u...O.s.h... .....p.[.....M.[...t...r.....k.......s.[...j... .....y.....O.s.h... .....w...r.....O.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zh_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.932307687640496
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM76E7lqt6Enln:Svi6gqttl
                                                                                                                            MD5:6A2BE9D9E2A53419CFDA1820DA3CDB60
                                                                                                                            SHA1:D9354DEA3AEB269C8DBEFFE2AA41FFCBBFA737B4
                                                                                                                            SHA-256:AFD2CC131926A8D03C35D770BDB2D2BB92EF2F3A02B7FEB4293BE1D69A1BCA2F
                                                                                                                            SHA-512:973DD278E08B0F787835BA45DCD4359B7AE587C9B151F304D127F1BDCC127ED098EAE6A72E11AD58E8A971BDCA339E8646C38DF04B111A8269152F7FBB9C52E8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..2....................2..............2

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zh_Hans_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1040
                                                                                                                            Entropy (8bit):5.389035174290986
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:fOHM7iiRd8YR4EzlqAIjI59gQ1EzlqAIzUzuUFYXcRUkC/5Qp6+EsF/jtL7qHwmz:3xhlbuqLelb7RZEFLX0srN
                                                                                                                            MD5:26B42AE469D40966DD8F593075E51DA3
                                                                                                                            SHA1:3877D9BE4348E3C9D6BCAB1EBCAD2C64BC21FCA9
                                                                                                                            SHA-256:0006536EAE7598E66586CDE3E411F7C519FC1C8A80A2B175248EC49064ABBCAC
                                                                                                                            SHA-512:C28EA9F75461721E93D14B8E662A00E91BBB2E3F6193EA6262C362BB1E6D44B3A64E545EF908FAEECADE6E3999221DC4684F1433167AA147DA90F01C2E78BF26
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .fl...................fl.........0.0.0..N.N..d./.M./.y...E.....E.,. .d./.M./.y.G.G.G.G.G.....J.il..J.hl..J.gl..J.il..J.hl..J.gl...P.PE#.C.].k.kb.................... ..`5J...elJ...elJ....P.PE#.C.].k.k.=....................!........4.N...E..{lvlyl.......B.B.................*....$....R.R.R..$..]....$....4.4.4...P.PE#.C.]K_K_c...................W.!....... ..4.N.E.4..N.ml.).4.......B.B.................*....$....R.R.R..$..]....$....4.4.4...P.PE#.C.].k.kb..............P.PE#.C.].k.kb...............!.. .L...P.PE#.C.].k.kb.................!.....F...J.....J..............P!..P$..P..7.... ........'..P*..P-..P..7.... ..*........ ... ....... ........0...>..P.....P.`.P.`E#.`.C.`C...F...I...:7.`...`...`...`...`...`..........I.M.P......... ...k..Pp..P...`s..Pv..Py..P...P...P......5.L...Z..P... ..I.M.P......... ......P...P...`...P...P...P...P...P......5........P... .......................P...............P........`.......... ... ... ... ... ... ... ...........P...P....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zh_Hant_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4644
                                                                                                                            Entropy (8bit):5.7980756728475376
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:nD0t0AhbysgPLVmOxdcc/ggycFIc/G9kl9YZIFPzRucL+5:gaPf0mIX9kl9oyzM
                                                                                                                            MD5:2B6769071D3D531FA1C1B64BA54480E8
                                                                                                                            SHA1:43E33BEF27C95267C09760D1238260AE8B760BCB
                                                                                                                            SHA-256:1AAF0609F0DDF59FFB261FBFE754792B7F42584AD83DA818034A1F92334D851E
                                                                                                                            SHA-512:7651524903AA542D2FA23EFAFA078D3A5D18BD0EB22174A5C87539E3716539FE94E65D6365FF3CA13C01410E96A3EFA876DCCADF8C6BB90FA84DA72E1EA75A59
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................v.. ..{.............,......{..........e.N..Zf.N...Nt^...Nt^...Nc[...N.e..MR.e..._.e...f.e..(f.e...Nc[...Nc[..,g.f.g...N.f.g...N.f.g...f.g~^.....R.......P.\Bf..,g.f.g.N..,g.f.g.N..,g.f.g.N..,g.f.gmQ..,g.f.g.V..{.0.}.."..."{.0.}....].S.{4V..,g.f.g.N..,g.f.g.e...T.].{4V...N.N.{4V...T.N.{4V...T.S.{4V..+.{.0.}.Q...M..g,{W.1...Y.t^,{w.1...{.0.}..RMR..{.0.}..R._..{.0.}.t^._..{.0.}..eMR..{.0.}..e._..{.0.}..y._..G.y.t^.y.t^..d.-.M...E.....{.0.}..P.gMR..{.0.}..P.g._..{.0.}..\BfMR..{.0.}..\Bf._..{.0.}..f.gMR..{.0.}..f.g._..{.0.}..S{.1.}...{.0.}. ..f.gMR..{.0.}. ..f.g._..{.0.}.."{.1.}...G.y./.M..y./.M...d./.M. .. .d./.M...M./.y. .. .M./.y...U...r...t^M.M.M.d...d./.M./.y. .. .d./.M./.y...U...r...t^M.M.M.d.E.E.E.E...d./.M...E... .. .d./.M...E.....d./.M./.y...E... .. .d./.M./.y...E.......$./.<...*.7..|.|.|.|.|.|..J.m...J.....J.....J.q...J.....J.....J.]...J.....J.....J.U...J.....J.....J.n...J.....J.....J.r...J.....J.....J.^...J.....J.....J.V...J.....J.......!.y#

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\af.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20600
                                                                                                                            Entropy (8bit):4.710087176621795
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:RO7EpdiGx3F9nkphQvEvnVrLfnGVrEBkRo70LoBO2oSm6:IMd9VY70L2Gi
                                                                                                                            MD5:618BF105AA359F19B795895062E8EF83
                                                                                                                            SHA1:A1765E32A5AF318306C5DDE3E535614B2ED6AD4F
                                                                                                                            SHA-256:1BB55FDC74E76E0D911DD8B54E2609D6340A943B1D22F7C902609F56400341CB
                                                                                                                            SHA-512:F2C669E19D67281CF396331F8145E12C928AAAF1D66252BFC0FFB599FAA666109207E94D489559DEC083DDDFF5146C29E395EAA80421194F574ECBAE72115611
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ."..............G.....".....n.pQ..K.i...f...P.a.a.s...W.e.n.e...A.s.o.r.e...K.a...r.o...P.a.r.y.s...P.r.a.a.g...R.i.a.a.d...S.e.o.e.l...B.e.r.l.y.n...D.o.e.b.a.i...K.a.b.o.e.l...B.r.o.e.n.e.i...K.a.a.i.m.a.n...K.a.n.a.r.i.e...K.a.r.t.o.e.m...S.a.r.a.t.o.f...W.a.r.s.k.o.u...{.0.}.-.t.y.d...A.p.i.a.-.t.y.d...D.j.a.k.a.r.t.a...D.j.i.b.o.e.t.i...H.o.v.d.-.t.y.d...I.r.a.n.-.t.y.d...K.a.r.a.t.s.j.i...K.u.b.a.-.t.y.d...M.a.l.e.d.i.v.e...M.a.t.a.-.U.t.u...N.i.u.e.-.t.y.d...O.m.s.k.-.t.y.d...P.e.r.u.-.t.y.d...A.s.o.r.e.-.t.y.d...C.h.i.l.i.-.t.y.d...C.h.i.n.a.-.t.y.d...C.h.u.u.k.-.t.y.d...D.a.v.i.s.-.t.y.d...F.i.d.j.i.-.t.y.d...G.l.a.c.e.b.a.a.i...G.o.o.s.e.b.a.a.i...J.a.p.a.n.-.t.y.d...K.a.t.m.a.n.d.o.e...N.a.u.r.u.-.t.y.d...N.e.p.a.l.-.t.y.d...P.a.l.a.u.-.t.y.d...S.a.m.o.a.-.t.y.d...S.i.n.g.a.p.o.e.r...S.y.o.w.a.-.t.y.d...T.o.n.g.a.-.t.y.d...A.l.a.s.k.a.-.t.y.d...A.n.a.d.y.r.-.t.y.d...E.i.l.a.n.d. .M.a.n...G.u.y.a.n.a.-.t.y.d...I.s.r.a.e.l.-.t.y.d...K.a.a.p.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\agq.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\as.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):28844
                                                                                                                            Entropy (8bit):4.8624824473043695
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:Wz7MIuz9Q0izAdzKn44TlqOXY7Ai4mtZ0ol:Wz7MIuz9f3clqOCAi/j
                                                                                                                            MD5:6B4CC9E2BB391A6C39697A2B1E13377B
                                                                                                                            SHA1:E6CABD5F2E9281181B6EFA60840D4970B20E2ED3
                                                                                                                            SHA-256:E8A040142868D625961515E2E34FBAD3A9D99B25F0FF732015789394FAD222A5
                                                                                                                            SHA-512:16B12CF835EB5285F2D2A3E216BA34A7FE1E5B651FFA645500EC72CD91B04F76257A3FDF037F9C4576AB26370416DCD732C0197A3AFF532F1C31BF4B70085342
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .lG.....#...#...C.....lG....n.pQ......................................................................................................................................................................................................................................... ............................................................................................................................................................................................................................................................................. ................................................................................................................................................................................................................. .................................................................................................................................... .....................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\bas.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\bem.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\bg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25388
                                                                                                                            Entropy (8bit):4.821860981536896
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:2z/Z/Lz/7N1KKvdaKT5l93GOX038P+207S:2rBLr7N1KKvdaKT5l93GOX0CrN
                                                                                                                            MD5:9D84C23D88CD13DBA3F72AB07F044EFE
                                                                                                                            SHA1:A4FF53C3627F58FDC205417EA3C44E92F7B69337
                                                                                                                            SHA-256:2189E53495AFB7A728485A2290ACDBBEB667018398269728038384E5474464DE
                                                                                                                            SHA-512:B536FFA184DEBFAE23B12CB09B8B03BB8D02E807EE5B4BFEBA945BE1D1387C0811CE9C2E706D3C98DEFF1625363F0ED20F77794790872D401D9BD8C0C8E99275
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ...............G......T...n.pQ....0.5.....?.8.O...'.C.N.:.....@.0.;.....N.;.0.....8.2.8.....J.@.8.....>.:.A.....>.C.<.....J.@.B.....0.O.=.0...".0.9.?.5.....>.9.A.8.....8.5.=.0.....0.9.5.=.....0.9.@.>.....C.G.8.=.....0.9.>.B...!.8.4.=.8...#.>.;.8.A...%.C.E.C.9...'.C.O.1.0.....0.<.1.8.5.....>.H.@.0.9.....>.C.A.J.=.....B.J.@.0.C.....0.=.:.>.:.....8.;.=.N.A.....J.@.=.7.8.....5.=.2.J.@.....6.J.@.A.8.....>.C.A.J.=.....J.1.;.8.=.....;. ...N.=.....0. ...0.A.....8.4.C.5.9.....0.;.<.J.@.....E.5.=.O.=...!.5.=.B.J.@...!.:.>.?.8.5...".0.@.0.C.0.....=.3.C.8.;.0.....0.=.4.6.C.;.....@.N.:.A.5.;.....C.:.C.@.5.I.....8.5.=.B.O.=.....8.=.A.5.=.A.....@.8.=.C.8.G.....C.0.O.:.8.;.....C.A. ...5.9.....>.;.:.0.B.0.....@.5.A.B.J.=.....C.8.A.2.8.;.....0.@.5.=.3.>.....5.;.1.J.@.=.....8.:.>.7.8.O.....N. ...>.@.:...!.0.=.B.O.3.>...!.5.9.H.5.;.8...#.8.=.0.<.0.:...#.8.=.8.?.5.3...%.>.=.:.>.=.3.....0.2.@.8.F.8.9.....=.:.J.@.8.4.6.....@.8.7.1.5.9.=.....C.3.5.=.2.8.;.....C.4.0.?.5.I.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\bo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):120
                                                                                                                            Entropy (8bit):3.627526768396092
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tl+OsB/pll9l/JlROlIlXqkxPlu9l13lPP6n:SvuOElROqhPlYY
                                                                                                                            MD5:2E73166BDB1D4DC461A53A884E7B63A6
                                                                                                                            SHA1:E25361BD9881C21155B512E85C4206BF5A68F166
                                                                                                                            SHA-256:B3C0A1262290D2DF85B304E0AA12A77AA2224BBC63482E290D4DBE2406B871CF
                                                                                                                            SHA-512:96F7FAEFE92AD8E8DEAA63439E9C72E1A2A548B89AD542C36E8B98DB5E60FE2BA46FA3E29EDC7318EEBE4D79255630B95AE44C4B9311079EFC82D347FB61290D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .S....................S.....n.pQ..X...b...|.B.f...T.....#.T........P........R..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\bs_Cyrl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17336
                                                                                                                            Entropy (8bit):5.139077167547189
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:BVzZjdzVQD/b39FrQWEX2bjkMCrUwt6m3XDTUZ:LzZ9C/b39aWrwfrUwgEfUZ
                                                                                                                            MD5:2018A278B686B8FAE3CED280A8DDB441
                                                                                                                            SHA1:7BF83B51BF064DE0239EC8184A7F52CB164BD937
                                                                                                                            SHA-256:4C3A0E1F66749F2E497666BEDA521505AFFFBFE4465EFC5D58E8B18DC6A5D9DD
                                                                                                                            SHA-512:C24935034297DF1FAC5311BEBDB633EC29F36ABDF89EA38E72909DD908FAC49796A9E62321A39F8415177101499382A210F7AF7306145D8F8F2F939F5D2AB2B7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .L..............'.....L.....n.pQ....5.G.....D.0.B.....@.0.3.....5.@.A.8.....7.>.@.8.....0.E.8.0.....8.A.0.>.....>.6.8.[.....C.0.=.0.....C.6.C.8.....C.:.;.0.....0.A.5.X.....0.X.5.=.....8.X.5.2.....>.H.@.5.....C.@.8.5.....0.:.0.C.....0.=.:.>.:.....8.Y.=.C.A.....>.B.E.0.1.....@.:.C.F.:.....0.B.E.0.<.....8.@.0.A.>.....C.8.0.1.0.....0.4.5.@.0.....0.@.:.8.7.....0.X.C.@.>...!.:.>.?.Y.5.....5.@.5.2.0.=.....:.C.B.>.1.5.....=.B.8.3.2.0.....5.>.3.@.0.4.....;.0.=.B.8.@.....@.C.=.5.X.8.....0.1.>.@.>.=.....8.H.8.Z.5.2.....C.8.2.8.;.5.....>.3.0.4.8.H... .5.A.>.;.C.B... .5.C.=.8.>.=...!.2... ...>.=...#.@.C.<.:.2.8...#.H.C.0.8.X.0.....0. . .8.>.X.0.....>.@.4. .%.>.2.....0.2.0.:.H.C.B.....8.B.:.0.8.@.=...!.0.@.0.X.5.2.>...!.2... .".>.<.0...".5.;. .!.8.B.8.....C.<.C.<.1.0.H.8.....0.@.0.<.8.@.1.>.....C.1.0. .2.@.5.<.5...!.2... ...5.;.5.=.0...".@.C.:. .2.@.5.<.5.....0.;.8.2. .2.@.5.<.5... .8.>. ...5.;.5.3.>.A.....Y.0.H.:.>. .2.@.5.<.5.....>.@.5.X.0. .2.@.5.<.5.....>.=.0.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ccp.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):51488
                                                                                                                            Entropy (8bit):4.166628682082664
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:dQR0ti9JsZ8vPJ94bvXvIAvGTvusv7r/v7gvUv7dv7hv7v7mv7zv7bv79v7kvUER:YPv9+3DV8h/N
                                                                                                                            MD5:A6177E4FDF9E69B2DD3BD46529563EB5
                                                                                                                            SHA1:92B44DD562E270E0B57AAC0753D53168E09B8401
                                                                                                                            SHA-256:DA18DAFE0470C119EBE9320B6C2FE3FB8D30AD6C82CCB2FFD1A73F6FD4B778AB
                                                                                                                            SHA-512:162D068518BAC2B432E7E43F362E325A9DC495D5E2F71845BDED8E1C73C086E8C45B711D831BA41D42EED2F1ECC40A661CD3138CC4C83CB6263D25C808309EE6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................<2. .lG.....@2..@2..B.....lG....n.pQ............................ .............(.............*............."...$...........................*.........&...,....."...(.........#...(.........%.......".....%...(...$.....&.....................3...".................4.............(... ............."...4.........1.......4.............-.............*....................."...4............. ...#.........(...".............*...#...(.........(...#...(.........*.......-.........%.......*.........*.......4.................4.........#.......*.........(.......(.........%.......*.........&...(... .................1.........#............."...........4.....#...*...%.........#...........,.....%...........-.....&..."..."...,...2...1...4.8...8.8.....#. ...........4.........(...........,.........,..."...*................."...#...4.............,..."...(.............*...#...4.............,.......4.............4.......#......... ...4...".............&...,.......4.........'...".......

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ceb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2344
                                                                                                                            Entropy (8bit):3.8096174694386007
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:U/lkGWXtKcRtKDYGkEpKsu8obAXIgAJKlzV5GrryVhV6qrYIoENlNrvxyZeZ9:Uj6TtKhr2AXvAJKrUvEj6OxNlN1yZeZ9
                                                                                                                            MD5:A331E7B5A5AE00C5919C939B726D8050
                                                                                                                            SHA1:927E89E14F00A69CCA0CC9C775F74BC620CD8C98
                                                                                                                            SHA-256:34A46FE41B98599E75A33B9C3262FC27D36D7CABEA4E180801475A5D824E00C0
                                                                                                                            SHA-512:11C5E425F00E0F7BBD767E66DE0F6292A7240348A5DA866C87F92BF8943FB1CD7B3E8175DC0BE99FF1F8628CF8F9C0F83A619B1A418F1AB045403D72B9C13373
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................>.. .lG.....B...B.........lG"...n.pQ..{.1.}. .{.0.}...T.a.g.-.i.n.i.t. .O.r.a.s. .{.0.}...S.u.k.d.a.n.a.n.g. .O.r.a.s. .{.0.}...W.a.l.a. .M.a.i.l.h.i.n.g. .S.i.y.u.d.a.d...N.o.r.t.e. .A.m.e.r.i.k.a. .S.u.k.d.a.n.a.n.g. .O.r.a.s...K.a.s.a.r.a.n.g.a.n.g. .O.r.a.s. .s.a. .G.r.e.e.n.w.i.c.h...N.o.r.t.e. .A.m.e.r.i.k.a. .O.r.a.s. .s.a. .P.a.s.i.p.i.k.o...N.o.r.t.e. .A.m.e.r.i.k.a. .O.r.a.s. .s.a. .S.i.d.l.a.k.a.n...N.o.r.t.e. .A.m.e.r.i.k.a. .O.r.a.s. .s.a. .A.t.l.a.n.t.i.k.o...N.o.r.t.e. .A.m.e.r.i.k.a. .O.r.a.s. .s.a. .K.a.b.u.k.i.r.a.n...T.a.l.i.w.a.l.a. .n.g.a. .O.r.a.s. .N.o.r.t.e. .A.m.e.r.i.k.a...K.o.o.r.d.i.n.a.d.o. .n.g.a. .U.n.i.b.e.r.s.o.h.a.n.o.n.g. .O.r.a.s...S.u.k.a.d.a.n.a.n.g. .O.r.a.s. .s.a. .K.a.s.a.d.p.a.n.o.n. .s.a. .E.u.r.o.p.a...S.u.k.d.a.n.a.n.g. .O.r.a.s. .s.a. .T.a.g.a.-.O.r.y.e.n.t.e. .s.a. .E.u.r.o.p.a...N.o.r.t.e. .A.m.e.r.i.k.a. .S.u.k.d.a.n.a.n.g. .O.r.a.s. .s.a. .P.a.s.i.p.i.k.o...O.r.a.s. .s.a. .K.a.s.a.d.p.a.n.o.n. .s.a. .E.u.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\cgg.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\da.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20012
                                                                                                                            Entropy (8bit):4.787487694159469
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:nqw4u2arR1dM+9zK+AbcRC9Iggzo7xePWBohrZw:nqluFq+8gS8M0Zw
                                                                                                                            MD5:EA14443A48A5785B950AF7DFF8058650
                                                                                                                            SHA1:AEB1E67A930670A0C7D22EEE0D4C7324D7919BA8
                                                                                                                            SHA-256:9EE65ACE547964B6B36ADF21BBDEDB156EA0FCC4962BB02DBC3DB6FE4F0B099E
                                                                                                                            SHA-512:004EBEE510F5D93AF0109698122286E556C4FD598BCF0901464530F081A4D06FAF6C80AAEF6161363C669864D2745FB777FEF4497031F5B67EDEAA037593BB62
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ."..............P.....".....n.pQ..A.c.r.e.-.t.i.d...A.p.i.a.-.t.i.d...A.z.o.r.e.r.n.e...F...r...e.r.n.e...H.o.v.d.-.t.i.d...N.i.u.e.-.t.i.d...O.m.s.k.-.t.i.d...P...s.k.e...e.n...C.h.u.u.k.-.t.i.d...C.o.m.o.r.e.r.n.e...D.a.v.i.s.-.t.i.d...J.u.l.e...e.r.n.e...L.a.n.g.a. .t.i.d...M.a.c.a.o.-.t.i.d...N.a.u.r.u.-.t.i.d...S.y.o.w.a.-.t.i.d...U.k.e.n.d.t. .b.y...V.a.t.i.k.a.n.e.t...A.l.a.s.k.a.-.t.i.d...A.n.a.d.y.r.-.t.i.d...B.h.u.t.a.n.-.t.i.d...I.r.a.n.s.k. .t.i.d...K.o.s.r.a.e.-.t.i.d...M.a.l.d.i.v.e.r.n.e...M.a.w.s.o.n.-.t.i.d...M.o.s.k.v.a.-.t.i.d...P.o.n.a.p.e.-.t.i.d...S.a.m.a.r.a.-.t.i.d...T.a.h.i.t.i.-.t.i.d...T.a.i.p.e.i.-.t.i.d...T.u.v.a.l.u.-.t.i.d...V.o.s.t.o.k.-.t.i.d...A.r.a.b.i.s.k. .t.i.d...A.r.m.e.n.s.k. .t.i.d...C.a.y.m.a.n...e.r.n.e...C.e.n.t.r.a.l.-.t.i.d...C.h.a.t.h.a.m.-.t.i.d...C.u.b.a.n.s.k. .t.i.d...E.a.s.t.e.r.n.-.t.i.d...G.a.m.b.i.e.r.-.t.i.d...I.r.k.u.t.s.k.-.t.i.d...J.a.k.u.t.s.k.-.t.i.d...J.a.p.a.n.s.k. .t.i.d...M.a.g.a.d.a.n.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\de.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):21760
                                                                                                                            Entropy (8bit):4.726886706277565
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:i9Br0QYulvmpDNbRbtaKN1CVxZ1DxZ3jIQ3ZhzbPbKdiimDXDnwqNTdYpxplFNMM:U5rv3GHrdPot2f
                                                                                                                            MD5:ABA4F91B8CBBD3EA505CA51DBE75FD05
                                                                                                                            SHA1:A580E14E2F768319440A12CC74A98814EBC6CAF6
                                                                                                                            SHA-256:DF20932397AE0BB6CBB84E5F9E561FC80432854BCFED82F24D1853EF11463F84
                                                                                                                            SHA-512:8C78D8A7164CAD53399F83DAC258772D222BA192C6DE21448C3C1968BCA2E332C1836B6E361352035AC2BB49D323098093270694E338FA8A5047915FE613A6A0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................4.. ."......8...8...Q.....".....n.pQ..C.h.o.w.d...E.r.i.w.a.n...K.a.n.a.r.e.n...K.o.m.o.r.e.n...S.a.r.a.t.o.w...T.s.c.h.i.t.a...{.0.}. .Z.e.i.t...A.c.r.e.-.Z.e.i.t...A.p.i.a.-.Z.e.i.t...A.s.t.r.a.c.h.a.n...G.o.l.f.-.Z.e.i.t...G.u.a.m.-.Z.e.i.t...M.a.l.e.d.i.v.e.n...N.i.u.e.-.Z.e.i.t...O.m.s.k.-.Z.e.i.t...A.q.t.a.u.-.Z.e.i.t...C.a.s.e.y.-.Z.e.i.t...C.h.o.w.d.-.Z.e.i.t...C.h.u.u.k.-.Z.e.i.t...D.a.v.i.s.-.Z.e.i.t...M.a.c.a.u.-.Z.e.i.t...N.a.u.r.u.-.Z.e.i.t...O.s.t.e.r.i.n.s.e.l...P.a.l.a.u.-.Z.e.i.t...S.a.m.o.a.-.Z.e.i.t...S.y.o.w.a.-.Z.e.i.t...A.l.a.s.k.a.-.Z.e.i.t...A.l.m.a.t.y.-.Z.e.i.t...A.n.a.d.y.r. .Z.e.i.t...A.q.t...b.e.-.Z.e.i.t...A.z.o.r.e.n.-.Z.e.i.t...B.h.u.t.a.n.-.Z.e.i.t...G.u.y.a.n.a.-.Z.e.i.t...K.o.s.r.a.e.-.Z.e.i.t...M.a.w.s.o.n.-.Z.e.i.t...P.o.n.a.p.e.-.Z.e.i.t...R.e.y.k...j.a...v...k...S.a.m.a.r.a.-.Z.e.i.t...T.a.h.i.t.i.-.Z.e.i.t...T.a.i.p.e.h.-.Z.e.i.t...T.u.v.a.l.u.-.Z.e.i.t...W.o.s.t.o.k.-.Z.e.i.t...C.h.a.t.h.a.m.-.Z.e.i.t...F.i.d.s.c.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\de_CH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):212
                                                                                                                            Entropy (8bit):3.886175955597824
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tl8FTlQx5JcllX0uz5726Jl+RlMlwlAux7kcx5kl6Ex84jXMAWGllJ/GC:SvETlQxs392QKv9kcx6x7XAySmN
                                                                                                                            MD5:B6402CF9F4A7B1B03BC76733DFFA977F
                                                                                                                            SHA1:43F41F91B5AA415806AF28FC7FDEEA896ED4D38D
                                                                                                                            SHA-256:C1204AE42804F7264392A1408F46673EFBE192E8034B0983B54F707CB1D36CA3
                                                                                                                            SHA-512:5AA07B411F1D861EBF543120D8F89AFA5B37A844903D411C1D2C190A3546EA01AF003A69A265A572B6D4076BA234EF34A9538B85CB510134B18D49E35289133B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................).. ..v.....-...-..........v!...n.pQ..B.r.u.n.e.i.-.Z.e.i.t...S.a.l.o.m.o.n.i.n.s.e.l.n.-.Z.e.i.t.....#.....#..v..#..!..5..v..5..v........>.`.%# ..P#..P&..P)..P,..P........T".`!..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_001.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):252
                                                                                                                            Entropy (8bit):3.5570860102991015
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlt5lI/Illl/uolilS2Mks9ks9ks9ks9ks9ks9ks9ksajtrI+58SU9tIS:Sv5IgN2oli0NTTTTTTTyDuiEW1M5N
                                                                                                                            MD5:7410A2E68E5324871E29EF1CE1EC3358
                                                                                                                            SHA1:388E5B0078C343AA1608D47E27105FA1263D5728
                                                                                                                            SHA-256:4B3E8A2D4C07E0C906AFDF11DBBB3A471805BE44E6AF6C1234622B3F1D2AA09F
                                                                                                                            SHA-512:7312A8D7C021FFCB839FE5755EFDB8E42BDBFA6D316E9D4833A7EC5CABCAD5756BEC57153BCB6D82E3F5593A8A30B2F96238454B54D3208C13F114286E50F1EC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................3.. .g......7...7.........g.&...n.pQ................................................................................................................................1...d......P...P...P...P...P$..P+..P2..P........f..`&..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_150.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):152
                                                                                                                            Entropy (8bit):3.8192580345823637
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlE4lhxczDVclS2Mq8avn0PfxWwk7kllnI6AuifD+f:Sv/sO0Nnav0P8wk7kl6xVDO
                                                                                                                            MD5:0C71A5B9C2CC51F08C3649005BD1667B
                                                                                                                            SHA1:9508AE1734F0C95DC9156EC6CB02F95AE23F975F
                                                                                                                            SHA-256:478DA27ACF835FB1C483F4D821C89B3470B887FDEA6E5C6CA60D67D565981391
                                                                                                                            SHA-512:153C672F0D957ABE9E54BBDAC31FE3835E9BE0B67B79F10C60172F9CEADF7922EDAD51C4DCAC1869315719DC4CFFB0E9D7ABF15B43B8C88C4175C7DA3C852757
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .g....................g.....n.pQ..............................................A.U......P...P...P..^%.......`f..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_AG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM4lzxlbkllMs:SvHjkss
                                                                                                                            MD5:7B933F365B0F6A04C6DB118E4A5C302E
                                                                                                                            SHA1:193D872892E0BE99BDEB813CF9BC6E6B9AE2022F
                                                                                                                            SHA-256:21EDA0DEA9E1F55F8E7A899B005526EA9D3D08E9338B7A57524E35C0D472D903
                                                                                                                            SHA-512:91C56392F9924F26BF28A803377B5EF517A3F4D0E5DDA3541C0A73BA33BCE1EC6B78B325C59B4DEFCCE830C4133E4BCAF118372067A5D9D05A0AC4E592D75980
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.g....................g.....n.pQ....^%....f.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_CH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.165365317526889
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlu1YlM68tbROl1ylh+V/9hAlP:SvKYlf8tROCl0WlP
                                                                                                                            MD5:2CBAA3E01A9CE225D0451E1F176E8F75
                                                                                                                            SHA1:05D436146BAD0B3926378FDA4143A3B19DC43B22
                                                                                                                            SHA-256:5FF27D8579BA400E855094F67D72E3DC577F68C734D6F3F57F510F7BC246DAAB
                                                                                                                            SHA-512:EF946D17BC1E6EF198E2A39BD61303DC0A147BFAB62C3B199EA6AB5D72B4D22232A34B5273C51EB9BA7730BF190CCD12B88EADFA4BCD37D666B9BEED2E3B232E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.\....................\.....n.pQ..2...1...4.8...5.0.....^%..[.].

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_CY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM4lzxlbkllMs:SvHjkss
                                                                                                                            MD5:7B933F365B0F6A04C6DB118E4A5C302E
                                                                                                                            SHA1:193D872892E0BE99BDEB813CF9BC6E6B9AE2022F
                                                                                                                            SHA-256:21EDA0DEA9E1F55F8E7A899B005526EA9D3D08E9338B7A57524E35C0D472D903
                                                                                                                            SHA-512:91C56392F9924F26BF28A803377B5EF517A3F4D0E5DDA3541C0A73BA33BCE1EC6B78B325C59B4DEFCCE830C4133E4BCAF118372067A5D9D05A0AC4E592D75980
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.g....................g.....n.pQ....^%....f.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_DE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.040932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM4lzxlbkllMEn:SvHjksE
                                                                                                                            MD5:2D23AF6F7FE7AE532F9E762BFE487A5C
                                                                                                                            SHA1:4742A78FC6D26E800814510D71749A05DA578C97
                                                                                                                            SHA-256:E9F6EF5729737BBD2236826FF878786D5009A6772997D0B363DAA04017BBF83E
                                                                                                                            SHA-512:03D2F1B5E1EDF75D120CBA0D19C5370FD34BC3000599B814B3D02519958E399BA61CE9CA98EC0798C7FC78C2F9FFABC488F0DB921537681F99163F0890122E77
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.g....................g.....n.pQ....^%..[.f.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_ER.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):152
                                                                                                                            Entropy (8bit):3.855671533556861
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlE4lhxvlRkls02l2kv+PYJGD26kD9Gl19l1SMuifDkfn:Sv/3kaV+PYE26ksv9aMVDk
                                                                                                                            MD5:A2FECB24B478F9A9E53E5BD8CB82947B
                                                                                                                            SHA1:3EBA18A74E53BC95B39065AD1C229181284F3BDE
                                                                                                                            SHA-256:55D9048A31CCFB28F5DA7A418A221D2CF8D488DA50DC7A125A7BBB0EB7BD01B4
                                                                                                                            SHA-512:69A04CF483233F71DFE3E3730A11E4A5E86B57946A3BC9BE823DCB7C5E0B3C26C771962242E226C82E8A72ABD29133E90DCC0AEFAFA2CEAB146ED4FB321439C1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .g....................g.....n.pQ..............................%.%.....|............P...P...P...P..^%.......`f..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_FI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.040932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM4lzxlbkllMEn:SvHjksE
                                                                                                                            MD5:2D23AF6F7FE7AE532F9E762BFE487A5C
                                                                                                                            SHA1:4742A78FC6D26E800814510D71749A05DA578C97
                                                                                                                            SHA-256:E9F6EF5729737BBD2236826FF878786D5009A6772997D0B363DAA04017BBF83E
                                                                                                                            SHA-512:03D2F1B5E1EDF75D120CBA0D19C5370FD34BC3000599B814B3D02519958E399BA61CE9CA98EC0798C7FC78C2F9FFABC488F0DB921537681F99163F0890122E77
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.g....................g.....n.pQ....^%..[.f.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_GY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):112
                                                                                                                            Entropy (8bit):3.4109969916960843
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlR5lrtb/qlGI+66klVslMuifDplF:SvtgoJ6PlVJVDplF
                                                                                                                            MD5:9EFB6ED6CAC3EAD15A742C8BF5CECB54
                                                                                                                            SHA1:5E7B33E53F9741CBC550D5EE112382CD02C366C5
                                                                                                                            SHA-256:0A4005F5B075396DA4042A83CDCD1CB467D1186F4EFCEBA63FC6C7369EF818E4
                                                                                                                            SHA-512:21C63B109F5AB8E928D0613B0A9C8FFF8272F1690A6924DFF684343694D65D8A574557748D3F613A350A2AF0240A5C657EFA36931342E946FEBF99AD39CE2CF0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .g....................g.....n.pQ..G.Y.T.......h...X....P..^%.......`f..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_IE.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.4172273424413175
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ4ltNccDVclsZbX/k9S7AuifDPf:SvbjD6aZbPkxVDPf
                                                                                                                            MD5:DBD254C05B2F7016838DB52702305EF2
                                                                                                                            SHA1:07DB118EAFF1BBF4EE9AFB2A048E18E126BAAF7C
                                                                                                                            SHA-256:2439742DC509B40C07C062E22565DDB37C567D2EE4667A938F866B8E0663AAC0
                                                                                                                            SHA-512:13DA3AB8CB16B84F951958B72BB3CD765B4E666F3C2D021DCFD8E30ABEF1014856A7B8BA8E2245C8CF4A8F54053225ADF1869FC4961209439EB7744762F33496
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .g....................g.....n.pQ......>........P..^%.......`f..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_LR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):152
                                                                                                                            Entropy (8bit):3.855671533556861
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlE4lhxvlRkls02l2kv+PYJGD26kD9Gl19l1SMuifDkfn:Sv/3kaV+PYE26ksv9aMVDk
                                                                                                                            MD5:A2FECB24B478F9A9E53E5BD8CB82947B
                                                                                                                            SHA1:3EBA18A74E53BC95B39065AD1C229181284F3BDE
                                                                                                                            SHA-256:55D9048A31CCFB28F5DA7A418A221D2CF8D488DA50DC7A125A7BBB0EB7BD01B4
                                                                                                                            SHA-512:69A04CF483233F71DFE3E3730A11E4A5E86B57946A3BC9BE823DCB7C5E0B3C26C771962242E226C82E8A72ABD29133E90DCC0AEFAFA2CEAB146ED4FB321439C1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .g....................g.....n.pQ..............................%.%.....|............P...P...P...P..^%.......`f..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_MH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):252
                                                                                                                            Entropy (8bit):3.5570860102991015
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlt5lI/Illl/uolilS2Mks9ks9ks9ks9ks9ks9ks9ksajtrI+58SU9tIS:Sv5IgN2oli0NTTTTTTTyDuiEW1M5N
                                                                                                                            MD5:7410A2E68E5324871E29EF1CE1EC3358
                                                                                                                            SHA1:388E5B0078C343AA1608D47E27105FA1263D5728
                                                                                                                            SHA-256:4B3E8A2D4C07E0C906AFDF11DBBB3A471805BE44E6AF6C1234622B3F1D2AA09F
                                                                                                                            SHA-512:7312A8D7C021FFCB839FE5755EFDB8E42BDBFA6D316E9D4833A7EC5CABCAD5756BEC57153BCB6D82E3F5593A8A30B2F96238454B54D3208C13F114286E50F1EC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................3.. .g......7...7.........g.&...n.pQ................................................................................................................................1...d......P...P...P...P...P$..P+..P2..P........f..`&..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_MY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):3.351654140053072
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQ0Nck/lVcls0dB7Auif5OFu/F:Svpl6a1V5dF
                                                                                                                            MD5:B7FA5D5D0FDDBB5B201996CBE4544E3F
                                                                                                                            SHA1:B305C10DFB009A33A4E30F7D967ABCD97DA19069
                                                                                                                            SHA-256:54667FE7932DA1B97C3A5C10D4CDFDE03FD023E18F31342A2E81EFCB47547B57
                                                                                                                            SHA-512:5208694DE7AB18035DD8EDF587D95C52653CA227D909C3FD0C01B7B5D3B41EFDCAB55221C59CDB05DDE4D5813A934E229677DDF8C9674A9B9478F7DD26F9C03C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .]....................].....n.pQ......;.... ...P..^%.......`\..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_NA.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):152
                                                                                                                            Entropy (8bit):3.855671533556861
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlE4xvlHtqls02l2kv+PYJGD26kD9Gl19l1SMuif5OF3Nn:SvPtqaV+PYE26ksv9aMV5MN
                                                                                                                            MD5:584B7ED10634A00ED0E4F58E9404CD0F
                                                                                                                            SHA1:F167A677FBC727A61D5AC6A326CF1F2EAA8E6073
                                                                                                                            SHA-256:D3E4B494D598C2C08DCDBB9379B164C95158BB673AAE0AD789124F46170937F3
                                                                                                                            SHA-512:F32C2E4FD559487D4B3E8A67392D5989EC99212453E1AFA2DCBBD22AB69C3E21C589790653D357A5C048C670E2961A1810AF3718823038BA9523164478468D0E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .]....................].....n.pQ..............................%.%.....|............P...P...P...P..^%.......`\..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_NU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMqxlVtqllMe:SvDtqse
                                                                                                                            MD5:7C270F310229B7A3BCEABD9AE3BE08B8
                                                                                                                            SHA1:B4FB1A986654111BEAA667E79A6EE7EFD3958C21
                                                                                                                            SHA-256:A865EC010C2680B1674F3F258F1AFF7A401E7ED6459F98C0699287FC05B8C520
                                                                                                                            SHA-512:1967B7F33051C0E665CDE999BF594921BA1376017895E2CD74B3863D8704BEABE9CB4D7E44BE46C038225A24C205A31310198682885E8BC7A14575860C5CC988
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.]....................].....n.pQ....^%....\.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_PH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMqxlVtqllMe:SvDtqse
                                                                                                                            MD5:7C270F310229B7A3BCEABD9AE3BE08B8
                                                                                                                            SHA1:B4FB1A986654111BEAA667E79A6EE7EFD3958C21
                                                                                                                            SHA-256:A865EC010C2680B1674F3F258F1AFF7A401E7ED6459F98C0699287FC05B8C520
                                                                                                                            SHA-512:1967B7F33051C0E665CDE999BF594921BA1376017895E2CD74B3863D8704BEABE9CB4D7E44BE46C038225A24C205A31310198682885E8BC7A14575860C5CC988
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.]....................].....n.pQ....^%....\.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_PW.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMqxlVtqllMe:SvDtqse
                                                                                                                            MD5:7C270F310229B7A3BCEABD9AE3BE08B8
                                                                                                                            SHA1:B4FB1A986654111BEAA667E79A6EE7EFD3958C21
                                                                                                                            SHA-256:A865EC010C2680B1674F3F258F1AFF7A401E7ED6459F98C0699287FC05B8C520
                                                                                                                            SHA-512:1967B7F33051C0E665CDE999BF594921BA1376017895E2CD74B3863D8704BEABE9CB4D7E44BE46C038225A24C205A31310198682885E8BC7A14575860C5CC988
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.]....................].....n.pQ....^%....\.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_SL.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):152
                                                                                                                            Entropy (8bit):3.855671533556861
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlE4xvlHtqls02l2kv+PYJGD26kD9Gl19l1SMuif5OF3Nn:SvPtqaV+PYE26ksv9aMV5MN
                                                                                                                            MD5:584B7ED10634A00ED0E4F58E9404CD0F
                                                                                                                            SHA1:F167A677FBC727A61D5AC6A326CF1F2EAA8E6073
                                                                                                                            SHA-256:D3E4B494D598C2C08DCDBB9379B164C95158BB673AAE0AD789124F46170937F3
                                                                                                                            SHA-512:F32C2E4FD559487D4B3E8A67392D5989EC99212453E1AFA2DCBBD22AB69C3E21C589790653D357A5C048C670E2961A1810AF3718823038BA9523164478468D0E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .]....................].....n.pQ..............................%.%.....|............P...P...P...P..^%.......`\..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_SZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):152
                                                                                                                            Entropy (8bit):3.855671533556861
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlE4xvlHtqls02l2kv+PYJGD26kD9Gl19l1SMuif5OF3Nn:SvPtqaV+PYE26ksv9aMV5MN
                                                                                                                            MD5:584B7ED10634A00ED0E4F58E9404CD0F
                                                                                                                            SHA1:F167A677FBC727A61D5AC6A326CF1F2EAA8E6073
                                                                                                                            SHA-256:D3E4B494D598C2C08DCDBB9379B164C95158BB673AAE0AD789124F46170937F3
                                                                                                                            SHA-512:F32C2E4FD559487D4B3E8A67392D5989EC99212453E1AFA2DCBBD22AB69C3E21C589790653D357A5C048C670E2961A1810AF3718823038BA9523164478468D0E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .]....................].....n.pQ..............................%.%.....|............P...P...P...P..^%.......`\..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_TZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):152
                                                                                                                            Entropy (8bit):3.855671533556861
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlE4xvlHtqls02l2kv+PYJGD26kD9Gl19l1SMuif5OF3Nn:SvPtqaV+PYE26ksv9aMV5MN
                                                                                                                            MD5:584B7ED10634A00ED0E4F58E9404CD0F
                                                                                                                            SHA1:F167A677FBC727A61D5AC6A326CF1F2EAA8E6073
                                                                                                                            SHA-256:D3E4B494D598C2C08DCDBB9379B164C95158BB673AAE0AD789124F46170937F3
                                                                                                                            SHA-512:F32C2E4FD559487D4B3E8A67392D5989EC99212453E1AFA2DCBBD22AB69C3E21C589790653D357A5C048C670E2961A1810AF3718823038BA9523164478468D0E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .]....................].....n.pQ..............................%.%.....|............P...P...P...P..^%.......`\..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_UG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):152
                                                                                                                            Entropy (8bit):3.855671533556861
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlE4xvlHtqls02l2kv+PYJGD26kD9Gl19l1SMuif5OF3Nn:SvPtqaV+PYE26ksv9aMV5MN
                                                                                                                            MD5:584B7ED10634A00ED0E4F58E9404CD0F
                                                                                                                            SHA1:F167A677FBC727A61D5AC6A326CF1F2EAA8E6073
                                                                                                                            SHA-256:D3E4B494D598C2C08DCDBB9379B164C95158BB673AAE0AD789124F46170937F3
                                                                                                                            SHA-512:F32C2E4FD559487D4B3E8A67392D5989EC99212453E1AFA2DCBBD22AB69C3E21C589790653D357A5C048C670E2961A1810AF3718823038BA9523164478468D0E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .]....................].....n.pQ..............................%.%.....|............P...P...P...P..^%.......`\..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_VU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMqxlVtqllMe:SvDtqse
                                                                                                                            MD5:7C270F310229B7A3BCEABD9AE3BE08B8
                                                                                                                            SHA1:B4FB1A986654111BEAA667E79A6EE7EFD3958C21
                                                                                                                            SHA-256:A865EC010C2680B1674F3F258F1AFF7A401E7ED6459F98C0699287FC05B8C520
                                                                                                                            SHA-512:1967B7F33051C0E665CDE999BF594921BA1376017895E2CD74B3863D8704BEABE9CB4D7E44BE46C038225A24C205A31310198682885E8BC7A14575860C5CC988
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.]....................].....n.pQ....^%....\.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\eo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.8041805894387437
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMr/66E7l7cls/DDn:Svq/66gQa/fn
                                                                                                                            MD5:093DE8623D6D1F9CDF81286A210EE1CC
                                                                                                                            SHA1:55B4F15F11A4CAC5916D97F1DFD223D44F3A3F0F
                                                                                                                            SHA-256:7A99245469289DB8E7452AF32179CF9FFA12DE7FA65536A9481E0C78C7F847AC
                                                                                                                            SHA-512:A00DDD2FFF9C37BF986872735ED3FB16B3642D898C4E4D221F981EBEE7D1A283ACF8C17ED459FF81F9F419B3FB4CB505A9D36355FF6071E93998F79F3E598FFB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..&....................&....n.pQ.......&

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\es.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22764
                                                                                                                            Entropy (8bit):4.579134794988456
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:8HI6wYEKPUC+AV0C9PcvycIIBV7+I25bA5Bo+jEypRlJd:8orpK8C+AVD0/j+I2ZALBRLd
                                                                                                                            MD5:E85C8E73BEA1878FB4B139F5B262E02C
                                                                                                                            SHA1:9D78A14D78B95D2E5B093787DE493EC89A360CB3
                                                                                                                            SHA-256:7DD88943034DE7C1E70760FC9884C35D93B8781A8DEA2F9E04106EAB6C2AE046
                                                                                                                            SHA-512:6DB91F89F22EF5FE9E2BB4CC48581BCC72DA5F03480CCDD2968FABB15F56113DF90BE463F917350630D3029439D9BA1B2F64A4CCC0C6D6AA71E1C3E077C78039
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................/.. .D......3...3...P.....D.....n.pQ..A.d...n...D.a.c.a...A.r.g.e.l...B.e.l...n...B.i.s...u...C.h.i.t.....D.u.b...i...K...r.o.v...T.i.m.b.u...T...n.e.z...A.b.i.y...n...A.n...d.y.r...B.a.r...i.n...B.e.l.i.c.e...C.a.y.e.n.a...E.r.e.v...n...J.a.r.t...n...M.a.n.a.o.s...S.a.i.p...n...S.k.o.p.i.e...S...d.n.e.y...Y.a.m.e.n.a...Y.i.b.u.t.i...Z...r.i.c.h...A.s.j.a.b.a.d...B.a.r.n.a...l...C.o.m.o.r.a.s...C.u.r.a.z.a.o...S.a.r...t.o.v...T.a.s.k.e.n.t...Y.a.k.a.r.t.a...A.s.t.r.a.c...n...B.r.u.s.e.l.a.s...C.h.i.s.i.n...u...E.l. .C.a.i.r.o...E.s.t.a.m.b.u.l...H.o.n.o.l.u.l.....K.o.s.t.a.n...i...N.u.a.k.c.h.o.t...S.h.a.n.g.h...i...U.a.g.a.d.u.g.......z.h.g.o.r.o.d...J.e.r.u.s.a.l...n...U.l.i...n.o.v.s.k...Z.a.p.o.r.i.y.i.a.....m.s.t.e.r.d.a.m...G.r.a.n. .T.u.r.c.a...S.a.n.t.o. .T.o.m.....E.l. .V.a.t.i.c.a.n.o...I.s.l.a. .d.e. .M.a.n...I.s.l.a.s. .F.e.r.o.e...L.o.s. ...n.g.e.l.e.s...S.a.n.t.a. .E.l.e.n.a...H.o.r.a. .d.e. .A.c.r.e...h.o.r.a. .d.e. .F.i.y.i...h.o.r.a. .d.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\es_AR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):156
                                                                                                                            Entropy (8bit):3.8338907553219608
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlHFf/glull55Jcl2ktlxl/pl2lZkbOa+/Q6+ne8vSMQtfkbN:Sv5IUR5O4WqobO1o/HvH4f6N
                                                                                                                            MD5:0FB437D334430CBAA4931566E18477F5
                                                                                                                            SHA1:093E013BE25D6827C504669A333D5482ACDB0B82
                                                                                                                            SHA-256:E8DC00AC382773E5D86B3701B5B09289978D50CC0DD0CB4E6EF975F18129259B
                                                                                                                            SHA-512:24A49A68686E89B025C74E83D21FB4987C0711BB1C32432DD6FE11E6BD7BC26B50E6E7F2C1A3CE819A07E215DCE37F8BFC0341EAF40BEAC5697B4D75E3BF8AAC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .]....................].....n.pQ..W.A.R.T...W.A.R.S.T...........d._._.........c.^.^...i.x......P...P..^%...._..`\..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\es_BO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):112
                                                                                                                            Entropy (8bit):3.382914428948526
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlrntbr5OllqZkg6tMMQtfkAN:SvrOakg6tx4fL
                                                                                                                            MD5:5ED6BE36E3AF9385F15F8C9A869F806C
                                                                                                                            SHA1:56F14B5F08AD95543A6AF2896D17397D1B2D5E75
                                                                                                                            SHA-256:61BB8B40B3585ABAF84250AAFB515305025821B362DD2E3865410235B7CDC74F
                                                                                                                            SHA-512:EAD67AA2CF5A350C3E7D3CE18E7502571BC4E64A7D517A983381CCF9ED0F3D41A731912B05F889AC4FD55B258A9822D179A9E9DAF4E8F2D1E1D3049D5FC5093D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .]....................].....n.pQ..B.O.T.......^...E....P..^%...._..`\..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\es_DO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.040932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMqxlVtqllMk6:SvDtqsk6
                                                                                                                            MD5:10E40DF5115F3C4978DCE4DA2E0D6451
                                                                                                                            SHA1:BC28046E014F618395E2CCCCC316C17ED91DAA4A
                                                                                                                            SHA-256:876F59B33BA2CA4DFCB619BAE86DA6165DF4955B09EC4FC989BC4E8FD4F1DF89
                                                                                                                            SHA-512:00E5DF6097B58ACFEE5B47748856A95F4E0CD920AE9C33A4D6ED71425B1714E7F2DC6031FEBC5EC4CCF216A1E3E3CAB2A3950999DC8343B746EE20747DBCF6FF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.]....................].....n.pQ....^%.._.\.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\es_EC.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):112
                                                                                                                            Entropy (8bit):3.4007715718056684
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlrntbr5OlgmZkgLsaMQtfkAN:SvrOOWkgm4fL
                                                                                                                            MD5:609E1049FBC3527EB61D51C82BC5333D
                                                                                                                            SHA1:B9A6E79053EB441328E6D474567069A99D264F26
                                                                                                                            SHA-256:0713312787DC30E6903ABED7D316D580C6427071FD16673E96621B446E9BA9D1
                                                                                                                            SHA-512:2421778496FBEFC0EA61C81DCBCE01B0E7EE6E9CFF3B116F7BC4AF0C67D0762013A91B392784CC3DD8E6FF72CF0696C9FB8C84464D5E499EBE21C63507D7139F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .]....................].....n.pQ..E.C.T.......^...4....P..^%...._..`\..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\es_GT.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.040932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMqxlVtqllMk6:SvDtqsk6
                                                                                                                            MD5:10E40DF5115F3C4978DCE4DA2E0D6451
                                                                                                                            SHA1:BC28046E014F618395E2CCCCC316C17ED91DAA4A
                                                                                                                            SHA-256:876F59B33BA2CA4DFCB619BAE86DA6165DF4955B09EC4FC989BC4E8FD4F1DF89
                                                                                                                            SHA-512:00E5DF6097B58ACFEE5B47748856A95F4E0CD920AE9C33A4D6ED71425B1714E7F2DC6031FEBC5EC4CCF216A1E3E3CAB2A3950999DC8343B746EE20747DBCF6FF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.]....................].....n.pQ....^%.._.\.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\es_HN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.040932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMqxlVtqllMk6:SvDtqsk6
                                                                                                                            MD5:10E40DF5115F3C4978DCE4DA2E0D6451
                                                                                                                            SHA1:BC28046E014F618395E2CCCCC316C17ED91DAA4A
                                                                                                                            SHA-256:876F59B33BA2CA4DFCB619BAE86DA6165DF4955B09EC4FC989BC4E8FD4F1DF89
                                                                                                                            SHA-512:00E5DF6097B58ACFEE5B47748856A95F4E0CD920AE9C33A4D6ED71425B1714E7F2DC6031FEBC5EC4CCF216A1E3E3CAB2A3950999DC8343B746EE20747DBCF6FF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.]....................].....n.pQ....^%.._.\.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\es_US.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):880
                                                                                                                            Entropy (8bit):5.1076431106135
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:GlO10lTlw0WelRWj7WUS8lQqqciigVWnz7mn:jvKUS8lDqjigVt
                                                                                                                            MD5:005590E5FD1DF5FB6ACFB74C1C32C1D7
                                                                                                                            SHA1:AAF654A259DC1C87D4325119284DBA3CE271D909
                                                                                                                            SHA-256:38F7EA608D52F4BD129ECF6E2963A1F443D7C2127C3DA0ABCAD0DA2972B27F19
                                                                                                                            SHA-512:7F6DB0B64B35B2EE656E9A58015006D27DC929EC3018C45E2CEEC9C4834DC27C9EA9B39C49E94C628C985DF7AD6CAB44C7D769E712CF7C47A06B98F765DA3B2C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ................%...........n.pQ..h.o.r.a. .d.e. .C.h.a.m.o.r.r.o...h.o.r.a. .d.e.l. .O.c...a.n.o. ...n.d.i.c.o...h.o.r.a. .d.e. .l.a.s. .i.s.l.a.s. .F...n.i.x...h.o.r.a. .u.n.i.v.e.r.s.a.l. .c.o.o.r.d.i.n.a.d.a...h.o.r.a. .d.e. .l.a.s. .i.s.l.a.s. .M.a.r.q.u.e.s.a.s.....#.....#.{G..#.....#.P!..#.M?..#.....#.....5.^...#.(7..#.....#.L7........\.............B...3.........R.,...........W...........5.............u.,.z.............#.....Hz........(.&.....5.....5.v|......5..........5....|....5.........5.............5.........5...........'.a.-...5./...5....5.x...5.....5.^|..5.F...5..]..5....5..n%.&...b.~...i.....................1.R...|...(.U.i.......d.... .!.!.!t"."%#+$w..Pz..P}..P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P...P..^%...._..`T".`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ff_Latn_CM.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/lcls8l:SBtkJ1li6gml/qa0
                                                                                                                            MD5:4F880C5D6BDDF339F850A87F0DC7BE2D
                                                                                                                            SHA1:90F0E7728BF802B7E962DB8434D1C562705F0613
                                                                                                                            SHA-256:B175F94ED5CE958A83AAB63677471AA4C0B2EA04FABA7C42681A5AEAEF8E5530
                                                                                                                            SHA-512:C9FC5B2F71F055D42C8501AAAAF6E6B6C290A6018CF1CFCB993735A01868850D0B3C5EAAD3A611C80D456AF9319DCF1F20CE4A8A0DB54736BA8C8D7089B54144
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ.....$..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ff_SN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.925547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/ql5DEMd4Pn:SBtkJYlU8g8l/qnEb
                                                                                                                            MD5:4167F884C4D893D3C4CF676EBA59ECCC
                                                                                                                            SHA1:F9BB765CDD97565E7F27DA2D29F5595E726EAF43
                                                                                                                            SHA-256:6FA9F3809A63EB8495058651296095C1F448FE0E626FD8E3C20A4BF21C92A818
                                                                                                                            SHA-512:E1172C023E0EFD679E505BB795D215705B78CBF938A3336E06A934D9645CAC47C070BDAB5C2C7F149209D3B2D9F7908F2851EAA8CEDADADF31C1292A178385D6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ..f.f._.L.a.t.n._.S.N......$....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\fi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22340
                                                                                                                            Entropy (8bit):4.587445833031727
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:09ChQS+N9XABGt8yG5QTvv5s6VPGvf31g6Ii778bUys79S2djA3A15BP/s6iIdxv:mV8h2FJwUcdeY00rF
                                                                                                                            MD5:90127A7DF92278761613D2C5C269506F
                                                                                                                            SHA1:4749C60F9BF1B69E2C70484627B2303BCB4E4925
                                                                                                                            SHA-256:48E2BABC11DBD696B4C9E73548576F5A4F28FCF7D50A3BC97CA0AB065E2FB8C8
                                                                                                                            SHA-512:19F38EB9D1EBD934E20820A06B19DA8D6AC6F1197FDF084A52C1C357F7B107432EFCAB62DF2C833F150DF07A4DEF2E1BFF2AD62A8368CDB9CA67D2A256C627B2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ."..............Q.....".K...n.pQ..A.q.t.a.w...K.i.o.v.a...R.i.i.k.a...T.a.i.t.a...A.t.e.e.n.a...A.t.1.r.a.w...A.z.o.r.i.t...L.o.n.t.o.o...A.a.g.a.b.a.t...B.r.y.s.s.e.l...G.o.d.t.h...b...H.a.n.d.y.g.a...K.o.m.o.r.i.t...M.o.s.k.o.v.a...P.a.r.i.i.s.i...V.a.r.s.o.v.a...B.e.r.l.i.i.n.i...C.h.i._.i.n...u...D.a.m.a.s.k.o.s...M.a.n.s.a.a.r.i...T.a.l.l.i.n.n.a...T.u.k.h.o.l.m.a...F...r.s.a.a.r.e.t...T.a.o.i.b.a.l.s.a...V.a.t.i.k.a.a.n.i...A.c.r.e.n. .a.i.k.a...A.p.i.a.n. .a.i.k.a...J.o.u.l.u.s.a.a.r.i...M.a.l.e.d.i.i.v.i.t...N.i.u.e.n. .a.i.k.a...P.e.r.u.n. .a.i.k.a...W.a.k.e.n. .a.i.k.a...t.u.n.t.e.m.a.t.o.n...+.H...m.m.;.-.H...m.m...C.a.s.e.y.n. .a.i.k.a...C.h.i.l.e.n. .a.i.k.a...F.i.d.~.i.n. .a.i.k.a...G.u.a.m.i.n. .a.i.k.a...H.o.v.d.i.n. .a.i.k.a...I.n.t.i.a.n. .a.i.k.a...I.r.a.n.i.n. .a.i.k.a...K.i.i.n.a.n. .a.i.k.a...K.o.r.e.a.n. .a.i.k.a...K.u.u.b.a.n. .a.i.k.a...M.a.c.a.o.n. .a.i.k.a...N.a.u.r.u.n. .a.i.k.a...O.m.s.k.i.n. .a.i.k.a...P.a.l.a.u.n. .a.i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\fil.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):20800
                                                                                                                            Entropy (8bit):4.655454957739464
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:scfinzfe5eIM4X0KsnaJWHro751BOIoNofTh:Xfuq5P0N6
                                                                                                                            MD5:C3330C381F55DB8725E606C466ED6A20
                                                                                                                            SHA1:85FE864A063EAE8C6A30B6920946E367D94ADC6C
                                                                                                                            SHA-256:A24C3C66C245EBFAD7E92205CFDF50F1F91ED978CA8D2B03BCDA636C8BC3A92D
                                                                                                                            SHA-512:B9F09B877013A8FCE6F5AF98AE3F5132BD78254ECB16075839804BBD52E9F8C881AC0B3D82BFB57993E998D4D1D7F931508431920045A8195B327E2FBB39536E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................D.. ."......H...H...H.....".....n.pQ..O.r.a.s. .s.a. .G.u.l.f...O.r.a.s. .s.a. .N.i.u.e...O.r.a.s. .s.a. .C.h.u.u.k...O.r.a.s. .s.a. .D.a.v.i.s...O.r.a.s. .s.a. .N.a.u.r.u...O.r.a.s. .s.a. .N.e.p.a.l...O.r.a.s. .s.a. .P.a.l.a.u...O.r.a.s. .s.a. .S.y.o.w.a...O.r.a.s. .s.a. .A.n.a.d.y.r...O.r.a.s. .s.a. .G.u.y.a.n.a...O.r.a.s. .s.a. .K.o.s.r.a.e...O.r.a.s. .s.a. .M.a.w.s.o.n...O.r.a.s. .s.a. .P.o.n.a.p.e...O.r.a.s. .s.a. .S.a.m.a.r.a...O.r.a.s. .s.a. .T.a.h.i.t.i...O.r.a.s. .s.a. .T.u.v.a.l.u...O.r.a.s. .s.a. .V.o.s.t.o.k...O.r.a.s. .s.a. .B.o.l.i.v.i.a...O.r.a.s. .s.a. .E.c.u.a.d.o.r...O.r.a.s. .s.a. .G.a.m.b.i.e.r...O.r.a.s. .s.a. .M.y.a.n.m.a.r...O.r.a.s. .s.a. .R.e.u.n.i.o.n...O.r.a.s. .s.a. .R.o.t.h.e.r.a...O.r.a.s. .s.a. .T.o.k.e.l.a.u...S.a.m.a.r.a. .D.a.y.l.i.g.h.t...S.e.n.t.r.a.l. .n.a. .O.r.a.s...O.r.a.s. .s.a. .M.a.l.a.y.s.i.a...O.r.a.s. .s.a. .M.a.l.d.i.v.e.s...O.r.a.s. .s.a. .P.i.t.c.a.i.r.n...O.r.a.s. .s.a. .S.u.r.i.n.a.m.e...L.u.n.g.s.o.d. .

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\fil_PH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/lcls8l:SBtkJ1li6gml/qa0
                                                                                                                            MD5:4F880C5D6BDDF339F850A87F0DC7BE2D
                                                                                                                            SHA1:90F0E7728BF802B7E962DB8434D1C562705F0613
                                                                                                                            SHA-256:B175F94ED5CE958A83AAB63677471AA4C0B2EA04FABA7C42681A5AEAEF8E5530
                                                                                                                            SHA-512:C9FC5B2F71F055D42C8501AAAAF6E6B6C290A6018CF1CFCB993735A01868850D0B3C5EAAD3A611C80D456AF9319DCF1F20CE4A8A0DB54736BA8C8D7089B54144
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ.....$..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\fo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18660
                                                                                                                            Entropy (8bit):4.849465373321238
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:J+zx2cNQ1oDZlmaxxrjoV4hZ+0fmuoo7SNRBOzb5a:QzHasx1hc0eEek9a
                                                                                                                            MD5:DBD5BB81EB3D90797262E6A56192A213
                                                                                                                            SHA1:F5741F88935D6293C8798889422631224A16678B
                                                                                                                            SHA-256:F4C36BE13BE6DA0D8C17FFA80B921B56811BCB23C0FFA010B2552E4B8A392D16
                                                                                                                            SHA-512:28924EC658702AA6A67855E1FFE422D88E97B7E1638B5B0BD02D28883BA6E9140882A3920E80AC370600EB39D8D1BE0690608F4F17184554985AF2666F5E4833
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................-.. ."......1...1...D.....".....n.pQ..G.a.s.a...B.e.l.i.s...B.a.r.e.i.n...K.u.v.a.i.t...F...r.o.y.a.r...{.0.}. .t.......2...1...4.8...9...A.p.i.a. .t.......C.u.b.a. .t.......F.i.j.i. .t.......H.o.v.d. .t.......I.r.a.n. .t.......K.i.l.i. .t.......K.i.n.a. .t.......M...r.i.t.i.u.s...N.i.u.e. .t.......O.m.s.k. .t.......P.e.r.u. .t.......S.i.n.g.a.p.o.r...V.a.r.s.j.a.v.a...A.z.o.r.u.r.n.a.r...B.u.t.a.n. .t.......C.h.u.u.k. .t.......D.a.v.i.s. .t.......I.n.d.i.a. .t.......J.a.p.a.n. .t.......K.o.r.e.a. .t.......N.a.u.r.u. .t.......N.e.p.a.l. .t.......P.a.l.a.u. .t.......S.a.m.o.a. .t.......S.t.o.k.k.h...l.m...S.y.o.w.a. .t.......T.o.n.g.a. .t.......V.a.t.i.k.a.n.i.....A.l.a.s.k.a. .t.......K.o.s.r.a.e. .t.......L.u.k.s.e.m.b.o.r.g...M.a.w.s.o.n. .t.......M.o.s.k.v.a. .t.......P.o.n.a.p.e. .t.......T.a.h.i.t.i. .t.......T.a.i.p.e.i. .t.......T.u.v.a.l.u. .t.......V.o.s.t.o.k. .t.........s.r.a.e.l. .t.......A.m.a.s.o.n.a. .t.......A.r.a.b.i.s.k. .t.......A.r.m.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\fr_GF.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):108
                                                                                                                            Entropy (8bit):3.3591523788867974
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlrg/slvl/U5OlGPl/bOk/tlllPPzf:SvEEPCOodTOirf
                                                                                                                            MD5:74B3A4A3E3DFDE9ADF9448221E5EA996
                                                                                                                            SHA1:7277F7B77A1AFB67ED204988FB6202C0E233A5D4
                                                                                                                            SHA-256:A15B59CAF06B44336F6E9046CECE35935500CC6F4851D0ECF624D46FA6E47C07
                                                                                                                            SHA-512:7FD4B0F078B3A9D9DF9BE0C37796E95B7E0E73D9755B91B65260273B474FEC5EA45BB2B255F6192CD935BA968ED9AC6CEA447BD80D6FDCEE141281CF6535738A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .]....................].....n.pQ..G.F.T.......^........P........\..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\fy.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18016
                                                                                                                            Entropy (8bit):4.247675192624289
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:HiiGZC3fksmmNWnajJMKFoMGrCe13e8TasnhDUM38HkH7etCQnt+dNbuLgFD:gZC3MsfPjJvoZZ13LpDUM3NatBcdN+s
                                                                                                                            MD5:19BD6A30658D60EA527D4F961A1B12AB
                                                                                                                            SHA1:1D47EAEC4553CA76FD8DF9461186B3A49301A544
                                                                                                                            SHA-256:C4608EBB73A5A11413381D8C2887441A008880E4ED8C818F2B5A5E9FD8F5BCD6
                                                                                                                            SHA-512:4E1DBFF1201D74F76839CEEE382CD3E1FE28A75D22B58694020DFC2F227B55EF69ACC8FF6383EED7B997924F2924C25225D440BFAF0C0C57C50F22C4174C968A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................n.pQ..C.a...r.o...P.a.r.y.s...W.e.n.e.n...B.e.r.l.y.n...P.r.a.a.c.h...F.a.e.r...e.r...I.r.k.o.e.t.s.k...K.h.a.r.t.o.e.m...S.j.a.n.g.h.a.i...{.0.}.-.t.i.i.d...A.c.r.e.-.t.i.i.d...H.o.v.d. .t.i.i.d...O.m.s.k.-.t.i.i.d...A.q.t.a.u.-.t.i.i.d...D.a.v.i.s. .t.i.i.d...K.r.y.s.t.e.i.l...n...L.a.n.k.a.-.t.i.i.d...S.y.o.w.a. .t.i.i.d...A.l.a.s.k.a.-.t.i.i.d...A.n.a.d.y.r.-.t.i.i.d...A.q.t...b.e.-.t.i.i.d...A.z.o.r.e.n.-.t.i.i.d...M.a.w.s.o.n. .t.i.i.d...M.e.x.i.c.o.-.s.t.a.d...M.o.s.k.o.u.-.t.i.i.d...N.i.u.e.s.e. .t.i.i.d...P.e.a.s.k.e.e.i.l...n...P...r.t.o. .V.e.l.h.o...S.a.m.a.r.a.-.t.i.i.d...S...d.-.G.e.o.r.g.i.a...T.a.i.p.e.i. .t.i.i.d...V.o.s.t.o.k. .t.i.i.d...A.m.a.z.o.n.e.-.t.i.i.d...B.e.l.a.u.s.e. .t.i.i.d...C.e.n.t.r.a.l.-.t.i.i.d...C.h.a.t.h.a.m. .t.i.i.d...C.h.u.u.k.s.e. .t.i.i.d...E.a.s.t.e.r.n.-.t.i.i.d...F.a.t.i.k.a.a.n.s.t...d...F.i.j.y.s.k.e. .t.i.i.d...M.a.c.a.u.s.e. .t.i.i.d...M.a.g.a.d.a.n.-.t.i.i.d...P.a.s.i.f.i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\gd.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):23536
                                                                                                                            Entropy (8bit):4.669685317674906
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:73Lu4wf1udeaneyK9CxGoEvE6SAhIBCt90ebBolEyedX:vhCt90eNPX
                                                                                                                            MD5:1D5A90E0F1F1ACDD3BD85AF4B6F3C1EE
                                                                                                                            SHA1:22142B21B22F9C93F640B4409FC7B803BDB3433B
                                                                                                                            SHA-256:53ADFB0D48FD9D37CBAC5CA4D941C0810A23F2BC5D78F5EE9A3A9C801C2F048E
                                                                                                                            SHA-512:AEF2445D8D19DF2EB87EE6919BEA149801C0723A3A94EC5BBB1D9BD0EA9A1FDE57F7151AD493E3F03D17B6D3F4C3600CD23348E76D4C7FC170B3C09468F12C7E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ."..............Q.....".v...n.pQ..T.S.B...F...r.o...G...s.a...P.r...g...R.+.g.a...A.m.m...n...A.r...b.a...M.o.s.g.o...P.a.r.a.s...S.i.d.n.i...T.M.k.y.M...A.s.m.a.r.....B.e.i.r.b.h...K.a.r...c.+...T.e.h.r...n...U.a.l.l.a.s...B.a.g.h.d...d...C.a.i.m.e.a.n...I.n.u.u.v.i.k.....m. .A.c.r.e.....m. .A.p.i.a.....m. .C...b.a.....m. .F...d.i.....m. .G.u.a.m.....m. .H.o.v.d.....m. .N.i.u.e.....m. .O.m.s.k...A.i.n.t...o.g.a...A.n. .R...i.m.h...B.a.c.h.r.a.i.n...B.e.a.r.m...d.a...B.r...n.a.i.g.h...C.u.i.b.h...i.t...D.i.a.m.e.u.g.a...G.r.e.a.n...d.a...G.u.a.d.a.l.u.p...R.a.p.a. .N.u.i.....m. .A.q.t.a.u.....m. .C.h.u.u.k.....m. .L.a.n.c.a.....m. .P.e.a.r.......m. .T.o.n.g.a.....m. .N.a.b.h.r.u.....m. .P.a.l.a.b.h...A.n. ...i.t.h.n.e...A.n.g.u.i.l.l.i.a...D.e...r.s.a.i.d.h...G.l.a.s.b.a.i.d.h...I.e.r.u.s.a.l.a.m...M.a.i.r.t.i.n.i.c...M.a.n.g.a.r.e.v.a...N.. D.j.a.m...n.a.....m. .A.l.a.s.k.a.....m. .A.l.m.a.t.y.....m. .A.n.a.d.y.r.....m. .A.q.t.o.b.e.....m. .B.u.t...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\gl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25988
                                                                                                                            Entropy (8bit):4.446503866012001
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:u5yST56w65n40o84EGUShxiQuUm/EV02oohqma0gmgZ9CAfNs4AIU9Br2OgltJd0:+yZnME/cTBs9rc+g7LP7HBOc6DZ89AA
                                                                                                                            MD5:CCF25A2391B64C4046D7791E4E11157F
                                                                                                                            SHA1:46074795DA2FA6F0C93DF5CC5D56CA8C90330AE3
                                                                                                                            SHA-256:77343E3C760CF2036620E41EAD789434EB51ABBE77A2E408F5D694D04B5CF6C4
                                                                                                                            SHA-512:69A0AC93BADF5AE1371B5E19E4E1D07FCA661B4344AD88B4C2B0D02206925725547C78F36B804E6217713387F5008BBA7F9CC8E3BFD853B3AC73C7DD902C8FD0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................U.. ."......Y...Y...G.....".....n.pQ..A.d...n...A.m...n...B.a.c.....B.a...a...A. .P.a.z...A.l.x.e.r...C.a.b.u.l...C.h.i.t.....T.u.n.e.s...A.n.t.i.g.a...B.a.m.a.c.o...L.u.s.a.c.a...O. .A.i...n...T.h.i.m.b.u...A. .R.i.o.x.a...I.a.c.a.r.t.a...I.e.r.e.v...n...K.h.a.r.t...n...O. .C.a.i.r.o...X.a.m.a.i.c.a...A. .H.a.b.a.n.a...A.s.t.r.a.k...n...B.r.u.x.e.l.a.s...H.o.n.o.l.u.l.....M.o.g.a.d.i.x.o...S.a.n. .T.o.m.....S.a.r.a.x.e.v.o.....z.h.g.o.r.o.d...A.c.h.k.h.a.b.a.d...H.e.l.s.i.n.q.u.i.....m.s.t.e.r.d.a.n...O. .S.a.l.v.a.d.o.r...O.s. ...n.x.e.l.e.s...R.e.i.q.u.i.a.v.i.k...I.l.l.a. .d.e. .M.a.n...P.o.r.t.o. .E.s.p.a...a...X.o.h.a.n.e.s.b.u.r.g.o...E.k.a.t.e.r.i.n.b.u.r.g.o...H.o.r.a.r.i.o. ...r.a.b.e...I.l.l.a.s. .C.a.n.a.r.i.a.s...H.o.r.a.r.i.o. .d.e. .A.p.i.a...H.o.r.a.r.i.o. .d.e. .C.u.b.a...H.o.r.a.r.i.o. .d.e. .H.o.v.d...H.o.r.a.r.i.o. .d.e. .I.r...n...H.o.r.a.r.i.o. .d.e. .N.i.u.e...H.o.r.a.r.i.o. .d.e. .O.m.s.k...H.o.r.a.r.i.o. .d.e.:. .{.0.}...H.o.r.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\haw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):148
                                                                                                                            Entropy (8bit):3.936161469353265
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlEO2oWvXclS2MYnES7OmaZ5UidlPPWFn:SvMoh0NYES7JaZ5UiS
                                                                                                                            MD5:F6DB885DC481ADA70E79194A29215141
                                                                                                                            SHA1:741D20DC95B0846BC02CA30D7FF386786E512A9B
                                                                                                                            SHA-256:EF63F894FB5F80380C15A01DB1055AD64DFC46E2FFED4E67DD5BF7139500B03E
                                                                                                                            SHA-512:CC4C87C80E6B392F70A4E20D322F5DB355AECD8E4168D30B42B7CDAD1F6FE9FC26231E691C3D472A7F6B39E5B8414993E61839CDEF003E313CA0B6339F4FC28E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .B....................B.....n.pQ..........\.............B...3.........'.a.-.......d....P...P...P........A..`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\he.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25968
                                                                                                                            Entropy (8bit):4.822707727401076
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:qq8mZge/E56J9iDlQzdweTCeEgfVTNeZsBX/0hNcV17baYBO+bgnjiuDwax:wSq65dw+deGF0PcV1nHjbgjiaZx
                                                                                                                            MD5:35AC0062FF005B40EC596263CA6F3C5F
                                                                                                                            SHA1:B6B32C7416AD6AEFD47C46C5B478DA9D6E759817
                                                                                                                            SHA-256:91F3C3ADF2D70C618F06ECD7E34F415BA6CF657B2A8F4DB9163AFD4B5D73D2A8
                                                                                                                            SHA-512:F7C841B696F543376CF872C8DC45E0CF090D5D678EC61B5DCB45B97257246C5577AB74F8DED1CFE6B4418FCBA33A2ABA30CE42570DBE046E610A5714A1DD402D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................P.. ..!.....T...T...O......!....n.pQ....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\hu.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22940
                                                                                                                            Entropy (8bit):4.7178692801383635
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:1WCR2KVuwG9inxiEhkZgxP3smTWOXSm6iMJciPs80AQ5XwzgodBo4ngrBpJ:dQvbUIPv0BZEx2pJ
                                                                                                                            MD5:B42DB2CAFAF88E78FF00DF60C75942E2
                                                                                                                            SHA1:BC3D36A18CABBF2D64138DD6810D58EF84CF35BD
                                                                                                                            SHA-256:A0B6E0260665C7896725EAC8DB6A920348BA25257A7875EF7B21BD8DF97A0169
                                                                                                                            SHA-512:E63EB27D0C1A521A008842572F78E16FFB25B7AAAD1093885CC1A703EECA6DF2CB7776029EA47593FEE7C36F071E920C3675ED6355B58149B605A2D6585133B3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................[.. ."......_..._...Q.....".....n.pQ..B...c.s...G...z.a...R...m.a...T.r.u.k.....d.e.n...A.l.g...r...A.t.h...n...C.s.i.t.a...K.a.i.r.....M.a.k.a.....M...l.t.a...O.m.s.z.k...P.r...g.a...S.z...u.l...T.o.k.i.....V.a.r.s.....B.i.s.k.e.k...F.e.r...e.r...F.i.d.z.s.i...K.a.r.t...m...K.o.m.o.r.....K.u.v.a.i.t...M.a.l.a.b.....M.i.n.s.z.k...P...r.i.z.s...S.z...f.i.a...T.o.m.s.z.k...T.u.n.i.s.z...U.n.g.v...r...Z...g.r...b...A.s.g.a.b.a.t...B.e.l.g.r...d...E.l.-.A.j...n...J.e.r.e.v...n...K.a.r.a.c.s.i...K.u.c.s.e.n.g...M.a.g.a.d...n...M.o.s.z.k.v.a...P.h.e.n.j.a.n...P.o.z.s.o.n.y...S.a.n.g.h.a.j...S.z.a.m.a.r.a...T.a.s.k.e.n.t...V.o.s.z.t.o.k...{.0.}. .i.d.Q...A.c.r.e. .i.d.Q...B.r...s.s.z.e.l...D.z.s.i.b.u.t.i...I.r.k.u.t.s.z.k...J.a.k.u.t.s.z.k...S.z.a.h.a.l.i.n...S.z.a.r.a.t.o.v...T.b.i.l.i.s.z.i...a.r.a.b. .i.d.Q...A.s.z.t.r.a.h...n...I.s.z.t.a.n.b.u.l...K.a.m.c.s.a.t.k.a...K.o.s.z.t.a.n.a.j...L.i.s.s.z.a.b.o.n...S.z.a.r.a.j.e.v.....S.z.i.n.g.a.p...r...U.l...n.b.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\hy.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):31400
                                                                                                                            Entropy (8bit):4.623794531707291
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:GGVhrTLIra5Q7DgXJrkk77wxJtmG1pSk3WQzY1BOyRK:9hrXImWIZkk77wxJtmGLRzYPhK
                                                                                                                            MD5:98B689EF955FB96BD71EB35CB84A72D8
                                                                                                                            SHA1:6DA982F170608ED44F894688C0E56DE9DCF4ED08
                                                                                                                            SHA-256:EFAE5C8F286397DA2E8E6760D25BC9E3BD803E0C078D7B954D611A11F330AEB3
                                                                                                                            SHA-512:C6EB126E21516486D45132A612CAE845294A8208C068A499D942C7521E1D6402A44FD87ABD01B5398955E6AC0AA3517BD846555721781D31A46B73907CFA54E5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .lG.............D.....lG7...n.pQ..?.k.....D.a.g...F.x.t...1.d.e.v...1.z.k.a...1.....a...3.a.f.a...4.k.l.k...<.k.t.a...<.x.t.e...@.x.~.d...@.|.x.t...I.k...a...J.e...i...L.k.c.a...T.e...k...U.t.}.o...U.}.l.x...V.k.{.k...1.i.e.v.....1.l.j.k.....1.t.t.a.v...2.a.k.u.a...2.a.v.c.k...2.a...x.....2.e.l.e.t...2.e.l.k.f...2.x.u.}.e...3.x...a.t...4.a...a.....4.a.....a...5.....a.v...7...a...e...9.a.k.i.k...<.a.c.x.}...?.a.u.e.v...?.a...a.....?.k...x.~...D.a.l.i.a...D.a.o.a.x...D.a.u.x.i...D.k.v.}.o...F.k.x...e...I.a.c.x.}...J...a.p.a...K.e...}.k...K.x...b.a...K.x...v.x...M.a.l...a...M.e.x...l...M.k...o.a...M.u.x.~.a...M.x...k.a...O.x.o.k.x...O.x.t.}.o...O.x...l.e...O...x.l.l...S.a...k.f...T.e.u.}.k...T.k.w.v.....1.b.k.{.a.v...1.l.t.a.i.k...1.o...a.x.....1.o...x.b.e...1.v.a.d.k.....1.}.t.e...a...1...x...b.a...2.a.r.d.a.d...2.a.t.a.o.x...2.e.|.l.k.v...2.k.w...e.o...2.k.}.a.x.....2.x.c.x...a...3.a.u.a.v.a...3.e...v.}.k...4.a...~.k.v...4.e.u.~.k.}...4.e.v.~.e.....4.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\id.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17048
                                                                                                                            Entropy (8bit):4.9398153997186025
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:cTznbpp4Rp8wRGP1+mc7bElA4A0C7eVaCMfe7NWUFiPvHuj7cXz66SoolrM7n3yN:cU8/N+FEu4iU5MfSWUiOj7celooq7CN
                                                                                                                            MD5:37DECE8933C2A4EC8EB048DECFE7EA75
                                                                                                                            SHA1:638B5B6C30A47BB72A2DAEF2047B232F1B5BB33E
                                                                                                                            SHA-256:C02E308964060F1DB7A635CAEED8E2638E20C7F986DED2F8119E2A25587ACFE7
                                                                                                                            SHA-512:1816143FA7A00A6CCB615B88FB0CF885393FCA8DAD2AE7F2D28FA2131BCB1256D8076074674EFA81D744125D987198953BB5E26887BB23AC71A3BE5448F9FD87
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .S..............P.....S.!...n.pQ..W.I.B...W.I.T...W.I.T.A...W.i.n.a...A.l.j.i.r...W.a.r.s.a.w.a...K.i.s.h.i.n.e.v...P.u.l.a.u. .M.a.n...W.a.k.t.u. .A.c.r.e...W.a.k.t.u. .C.i.l.e...W.a.k.t.u. .G.u.a.m...W.a.k.t.u. .K.u.b.a...W.a.k.t.u. .A.q.t.a.u...W.a.k.t.u. .C.a.s.e.y...W.a.k.t.u. .I.n.d.i.a...W.a.k.t.u. .L.a.n.k.a...W.a.k.t.u. .A.l.m.a.t.y...W.a.k.t.u. .A.q.t.o.b.e...W.a.k.t.u. .B.r.a.s.i.l...W.a.k.t.u. .J.e.p.a.n.g...W.a.k.t.u. .T.e.n.g.a.h...T.i.d.a.k. .D.i.k.e.n.a.l...W.a.k.t.u. .E.k.u.a.d.o.r...W.a.k.t.u. .M.a.l.a.d.e.w.a...W.a.k.t.u. .K.o.l.o.m.b.i.a...W.a.k.t.u. .T.i.o.n.g.k.o.k...W.a.k.t.u. .K.e.p... .C.o.o.k...W.a.k.t.u. .K.e.p... .L.i.n.e...W.a.k.t.u. .K.i.r.g.h.i.z.i.a...W.a.k.t.u. .Q.y.z.y.l.o.r.d.a...W.a.k.t.u. .A.f.g.a.n.i.s.t.a.n...W.a.k.t.u. .P.e.g.u.n.u.n.g.a.n...W.a.k.t.u. .E.r.o.p.a. .B.a.r.a.t...W.a.k.t.u. .E.r.o.p.a. .T.i.m.u.r...W.a.k.t.u. .P.u.l.a.u. .N.a.t.a.l...W.a.k.t.u. .S.t.a.n.d.a.r. .{.0.}...W.a.k.t.u. .T.i.m.o.r. .L.e.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\in_ID.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):88
                                                                                                                            Entropy (8bit):2.7376269297851303
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlKelBjlgljl/qlkBphlXW:SBtkJTl44iBpDW
                                                                                                                            MD5:6A062B4BD17710E30170823F502B0B5E
                                                                                                                            SHA1:26E68B38204EB89AB102DFDADEFBE3CAF9614D3F
                                                                                                                            SHA-256:461638F44C429A57DBABB202B97B8310B8E856D3A3DB69395622121D9D0AD833
                                                                                                                            SHA-512:BA8928D297DCDB049BDE94AFED3FEB1E924C745B5A6362D044F104F5A6D62EC18E32AFAF428D656A850396F25947599AC3ED2E3F2EE4FD76CF6B700A75BEBF9A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ..i.d._.I.D......$..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\it.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):23800
                                                                                                                            Entropy (8bit):4.5080804837934325
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:b9En6TDax0SRtvSfYLISCleB1w5fjzBOHgYfDE:5E6ixrSALulecb1I4
                                                                                                                            MD5:1227C3201D8D853109024248151D377F
                                                                                                                            SHA1:6FFEC15E72745296917D3EEE07938F9ADAC16B54
                                                                                                                            SHA-256:C4B9C2116340A9D7E598758C33317F02D00CF7B1373E426063D82A263FAA6DBB
                                                                                                                            SHA-512:F529605AC8A1B673BCF3FEFB3D7116F05E006372420819DA7A9E8CA39FD9115B02DD3A5EA7B43237456FB9353A820A01370CBF32F2B41B301D82143E94AD3C21
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................2.. ."......6...6...H.....".....n.pQ..A.t.e.n.e...G.i.u.b.a...A.l.g.e.r.i...G.i.b.u.t.i...N.a.t.a.l.e...P.a.r.i.g.i...T.u.n.i.s.i...Z.u.r.i.g.o...A.n.a.d.y.r.. ..B.e.r.l.i.n.o...C.a.i.e.n.n.a...C.a.n.a.r.i.e...D.u.b.l.i.n.o...E.l. .A.y.u.n...L.u.b.i.a.n.a...L.. A.v.a.n.a...O.r.a. .{.0.}...G.i.a.c.a.r.t.a...G.i.a.m.a.i.c.a...I.l. .C.a.i.r.o...V.a.r.s.a.v.i.a...Z.a.g.a.b.r.i.a...F.a.m.a.g.o.s.t.a...G.u.a.d.a.l.u.p.a...O.r.a. .a.r.a.b.a...P.o.r.t.o.r.i.c.o...S.a.n. .P.a.o.l.o...S.t.o.c.c.o.l.m.a...C.o.p.e.n.a.g.h.e.n...G.i.b.i.l.t.e.r.r.a...S.a.n.t.. E.l.e.n.a...G.e.r.u.s.a.l.e.m.m.e...L.a. .R.i.u.n.i.o.n.e...L.u.s.s.e.m.b.u.r.g.o...O.r.a. .c.o.r.e.a.n.a...O.r.a. .d.i. .A.p.i.a...O.r.a. .d.i. .C.u.b.a...O.r.a. .d.i. .H.o.v.d...O.r.a. .d.i. .N.i.u.e...O.r.a. .d.i. .O.m.s.k...S.i.n.f.e.r.o.p.o.l.i...I.s.o.l.a. .d.i. .M.a.n...O.r.a. .d.e.l. .C.i.l.e...O.r.a. .d.e.l. .P.e.r.....O.r.a. .d.i. .D.a.v.i.s...O.r.a. .d.i. .M.o.s.c.a...O.r.a. .d.i. .N.a.u.r.u...O.r.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\iw.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.915924628458436
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMP86E7l/Jclspmn:Svx6g/Oapm
                                                                                                                            MD5:C89AB79572AEE0973AA783D281FCDE07
                                                                                                                            SHA1:11E8372F90FBCAAD6BB059FEEFEF65BB0430F2E6
                                                                                                                            SHA-256:AE0A466EE3A80283293DB356A68145A8F511876CFF123DB28AAD481B87DAB44C
                                                                                                                            SHA-512:7CE0BDC3BA1A5E9387D62DA873C107273FB4FE38D0056C787199EB2A0BCEE30B0B0BF05C5D05FDF4A2250888FE3AE54BFE33AD39C14460A38EC66DB09A76DFC0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ.....$..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ja.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):19212
                                                                                                                            Entropy (8bit):5.735763854057635
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:V+F49oB3jHNJ5VpLBS6jNBMxtdSzLFiZ3QV0tyaMShZf9BoAeotcXB:2OoB3jHNJ5VpLfBBMxtdSHFiZ3QVbanG
                                                                                                                            MD5:5FDC594DEDC9EA7DA83F9BEF72CE054D
                                                                                                                            SHA1:319D830328309FDF87FD50D90A080104A547C5A3
                                                                                                                            SHA-256:C0E56C7B8C134BDF2149906569BD443DD8EB3635FD238510E25EBD45CE5E3937
                                                                                                                            SHA-512:5C5FA05E4A92EF3D40D0D9457075C36BCB12C9E896D2F2DBF3C2B5AE658BB4F73A287B26DA4E64A98D077CAAB5737D2B072469D692C59DC21EDEB2FB0C332401
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .lG.............Q.....lG=...n.pQ...0.0...0.0...0.0...0.0...0.0...0.0...0.0..s^.X..qg.N..../n..J.D.T...J.S.T....0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.\...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0.0.0.0...0

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ja_JP_TRADITIONAL.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):104
                                                                                                                            Entropy (8bit):2.923728528591944
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtldelFal9lDOldMJlnbv/1:SBtkJUlYC0JlnL/1
                                                                                                                            MD5:4DF3E79562D7D1384D3245D2C6E52DC8
                                                                                                                            SHA1:BF6B6612C1138276BC1D46E73419B7236D515633
                                                                                                                            SHA-256:E25DB564D313414F46DE6EBD4D57C19C2D55992E69BB47FF91EE633E1769C2FA
                                                                                                                            SHA-512:75744265C5EC9B48241FAA27A7F4C0EC54B8CCE70BBDD5B04AFAC90E41F2FEB27D1FF082137496C250E5BD5574A120A0D1B7637CCABB5142F205C9467E689C58
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ............................n.pQ..j.a.p.a.n.e.s.e......%......~%...P

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\jmc.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ks.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25556
                                                                                                                            Entropy (8bit):4.686397811770793
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:uQI6whMQuULn4D4p0io0t7vClnadncsIU7V5E4kHETCVtv4TCgyPL9rM6Dwi6CUK:uQILMQuULn4D4pto0t7vClnadncxU7Vw
                                                                                                                            MD5:F6F9E13B01FBACACB4C6548B5D5A777B
                                                                                                                            SHA1:6D16A044A8D6A8BA0ECEA7C1A76F4FB2601FAA40
                                                                                                                            SHA-256:CCBC4A94EA7849D2FA6794E5766E7A35CE83BF35FC2AC461E71345B12BE6DED6
                                                                                                                            SHA-512:1D7A02205EB28FA9A3AC7521717FEE422D8571D269745543A5DDD4637DBF0FA2A31DD25CBE0B25AB7C1EB6BD80537E10F9B65A58B0315BF96A37A0021C017FAC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .Xf...................Xf....n.pQ..3.H.D...F.P.H...y.1.....-.H.H...../.P.D.....1.P...'...:.'.2.'...A. .1.H...A.P.,.....D.P.E.'...E...H.y...F.H...3.......V.H...".~.P...'...'. ...1.'...'.H.1.N.D...'.N.E.'.F...'.P./.N.....'.....U.F...(. .D. .E...(.'.B.H.W...(.E.'...H...(.H...P.3...(...1.O.*...,.H.W.F.....-.H.'.F.'...-...(.r.y.../.N...'.1.../.O.(.N.....1.P...'./...3.P...F.....3...H.H.'...3.....N.F...B.'.(.O.D...B.N.*.N.1...E.'.(...F...E.'.3.N.F...E.'.D.y.'...E.'.........E.B.'.$.....E.N.F.H.3...E.P.F.3.....F.3.'.$.....F.H.E.......H.'./.O.2...H...D.P.3...H...H.......y. .D.P.F...y.H.....H...y.P.1...F...~.'.E.N.1...~.N.D.'.H...~.T.1.*.....~...1.P.3.......'...'.......H.P.3.....'.3.N.F.....N...1.H.....N.....F.....O.H...*.......E.N.F.......H.3....."...D...F.....'.N.B.y.H.(...(. .D...V.2...(.1.3.(...F...(.1.3.U.D.3...(.H...H.y.'...(.N...P...'...(.P.3.'.$.....(.P.4.........(.P.D.P.3.....(.T.1.D.P.F...*. ...1.'.F...*.1.~.H.D.....*.N...P.*.....*.N...~.......,.O.,.H.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ksf.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ky.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):23496
                                                                                                                            Entropy (8bit):4.892508392504618
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:ZFdee0sLkAK/sCXakRAeHLuC0CowZbnjXBOkgYfahWsQ:rdee0sLkR/tRxo2nNH67Q
                                                                                                                            MD5:348B448B9DF6BDCB75B69B7368E7C8B4
                                                                                                                            SHA1:B724E39E60A131647EDCBC5E0A7114C37DAD1A3D
                                                                                                                            SHA-256:E532525F93D83F54129C545F37458B4D2F96753CDDC40F913DA714F46619FE4E
                                                                                                                            SHA-512:ECAC208E93A503BF7DB5912B2E081CF921FB2DF277564DA288B955CC86704276FB31918E74BE56C29E79B44A92D5CB6D63C76488FE825E80D0A83BD9461E76B5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .G..............D.....G.....n.pQ....7.>.@.....0.3.8.....C.1.0...!.0.>.0...#.5.9.:...$.8.6.8...-.D.0.B.....D.8.=.K.....0.9.8.0.....M.2.8.A.....5.@.A.8.....A.B.5.@.....0.9.5.=.....C.G.8.......0.:.0.C.....9.0.<.5... .8.9.0.4...#.>.;.8.A...$.0.4.C.F...$.0.@.5.@.....0.<.1.8.5.....C.9.0.=.0.....8.1.C.B.8.....0.=.0.@.8.....>.7.@.0.5.....C.9.0.1.0.....0. ...0.A.....0.6.C.@.>.....0.9.>.B.B.....:.;.M.=.4...!.:.>.?.9.5...".0.9.?.5.9...#.H.C.0.9.0.....@...<.G.......=.3.C.8.;.0.....=.:.>.@.8.6.....C.A. ...5.9.....0.:.0.@.B.0.....>.=.A.B.>.=.....0.=.4.K.3.0.....@.8.A.<.0.A.....6.0.<.5.=.0.....>.@.>.=.8.0... .5.7.>.;.C.B...#.8.=.4.E.C.:...-.;. ...9.C.=.....B.8.:.>.:.0.=.....C.7.8.=.3.5.=.....8.5.=.B.8.0.=.....C.0.9.0.:.8.;.....0.9.0.?.C.@.0.....C.8.7.2.8.;.;.....0.:...Q.@.4.>.....0.@.:.5.7.0.A.....>.=.@.>.2.8.0.....>.=.A.5.@.0.B...!.0.=.B.8.0.3.>...#.8.=.=.8.?.5.3.....2.0.4.5.;.C.?.5.....C.0.6.0.;.5.9.=.....8.1.@.5.2.8.;.;.....0.=.3.8.@.B.C..... .0.3.>.B.>.=.3.0...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\lb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):16844
                                                                                                                            Entropy (8bit):4.396706133608963
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:TRiTvqMTJufO2ASV26dkaWe8iWhcoDrcYeGOSUbFC99JBI8lmBlysTSWRDDudWoA:TbHotfYoro4siNjtE6XPi4TptKN/nRh
                                                                                                                            MD5:B5BC7162FF7B709924872AEABA47BBD8
                                                                                                                            SHA1:8051BCE37F7CC1794FB14543E1A4598A1FF8DD88
                                                                                                                            SHA-256:4307A72ECB770C01AC632278E9C62F007955F6732B6E526354630CDE84680251
                                                                                                                            SHA-512:33CD96AE0B8405EEE28B101B466CE7928474C2B0EDAD991EC42BB5737420F18212088C3D420BEDFA36F2EB559EED415BE432FAAF51BF3C48AD49A0B17BD1ACD9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................g.. ........k...k...............n.pQ..R.o.u.m...Z...r.e.c.h...K.o.m.o.r.e.n...B.r...i.s.s.e.l...{.0.}. .Z...i.t...A.c.r.e.-.Z...i.t...G.o.l.f.-.Z...i.t...G.u.a.m.-.Z...i.t...H.o.v.d.-.Z...i.t...N.i.u.e.-.Z...i.t...O.m.s.k.-.Z...i.t...O.n.b.e.k.a.n.n.t...C.h.u.u.k.-.Z...i.t...D.a.v.i.s.-.Z...i.t...L...t.z.e.b.u.e.r.g...N.a.u.r.u.-.Z...i.t...P.a.l.a.u.-.Z...i.t...S.a.m.o.a.-.Z...i.t...S.y.o.w.a.-.Z...i.t...A.l.a.s.k.a.-.Z...i.t...A.l.m.a.t.y.-.Z...i.t...A.n.a.d.y.r.-.Z...i.t...A.z.o.r.e.n.-.Z...i.t...B.h.u.t.a.n.-.Z...i.t...B.r.u.n.e.i.-.Z...i.t...G.u.y.a.n.a.-.Z...i.t...K.o.s.r.a.e.-.Z...i.t...M.a.w.s.o.n.-.Z...i.t...M.e.x.i.k.o.-.S.t.a.d...P.o.n.a.p.e.-.Z...i.t...S.a.m.a.r.a.-.Z...i.t...T.a.h.i.t.i.-.Z...i.t...T.a.i.p.e.i.-.Z...i.t...T.u.v.a.l.u.-.Z...i.t...W.o.s.t.o.k.-.Z...i.t...C.h.a.t.h.a.m.-.Z...i.t...F.i.d.s.c.h.i.-.Z...i.t...G.a.m.b.i.e.r.-.Z...i.t...I.n.d.e.s.c.h. .Z...i.t...I.r.k.u.t.s.k.-.Z...i.t...J.a.k.u.t.s.k.-.Z...i.t...M.a.g.a.d.a.n.-.Z...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\lkt.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.804180589438744
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMZk66E7lillcls/jAn:SvEt6gika/8
                                                                                                                            MD5:70ADA25FCCA87A398A07454F1CCF8AF9
                                                                                                                            SHA1:BF6A6488EA65B58FEE6A38A4FAD9E8736103D80E
                                                                                                                            SHA-256:CEC9F7B0018C18423B65891DCCB8012E61798D06482F3CBE24B40F3A9EE73A44
                                                                                                                            SHA-512:5B71FA265E19ADF736DE9854CD69B07D7F34FE51D0195DBE0375808459235E37A97A9221D3E66AE2A9E8EE09D8D436FFF97CBAB66EBC5BFB11D5174901076D42
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..%....................%....n.pQ.......%

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\luo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\luy.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\lv.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):28080
                                                                                                                            Entropy (8bit):4.398950415400721
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:YvaSQDkn/IOAnEcBFrmtx0T/qBE92t9qgGasgZv6Zwota84NHc+Crw8T2ipVaSeo:uxQDfMGasVwoteK+NiKVLX8ZT
                                                                                                                            MD5:F1E7CF7CD6190E9A5D1A5F3D2A7CCD47
                                                                                                                            SHA1:71F397452FFC708639C9B2A594A377EB395EB96F
                                                                                                                            SHA-256:745CE455D67D8A8E7F121E672238D3827EE2F3D8A9EE2C27B549B82E3F452BEA
                                                                                                                            SHA-512:F8A54E3D0ADB504F2EA722BF56EE623AC8805FCF90AB7EF1E54908F9795B1D9FE6CDEEA811651B3764403A1367817F3D52F915D030C4182C92B72611CD449FD1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................`.. ..v.....d...d...G......v....n.pQ..M.a.e...K.a.r.i...N.a.s.o...N.o.m.a...N.k.k.a...R.+.g.a...V.+.n.e.....k.k.a...`.o.v.a...A.d.a.k.a...A.d.e.n.a...A.j.k.n.a...D.~.u.n.o...D.~.k.b.a...G.u.a.m.a...H.o.v.d.a...J.u.k.l.a...K.a.i.r.a...K.e.i.s.i...O.m.s.k.a...O.r.a.l.a...P.r...g.a...P...r.t.a...S.e.u.l.a...V.i.<.F.a...A.k.t.e.b.e...A.l.~.+.r.a...A.m.m...n.a...A.t...n.a.s...B.e.l.e.n.a...B.e.l.i.z.a...B.i.s.a.v.a...C.+.r.i.h.e...D.a.k.a.r.a...G.a.j...n.a...H.u.h.u.j.a...K.a.b.u.l.a...K.a.r.....i...K.a.t.a.r.a...K.i.j.e.v.a...K.i.r.o.v.a...K.u...i.n.a...L.a.g.o.s.a...L.a.p.a.s.a...M.a.j.o.t.a...M.a.p.u.t.u...M.e.h.i.k.o...M.i.n.s.k.a...M.o.s.o.n.a...N.o.r.o.F.a...P.a.r.+.z.e...R.i.j...d.a...T.a.i.b.e.i...T.i.r...n.a...T.o.k.i.j.a...T.o.m.s.k.a...T.r.o.l.l.a...T.u.n.i.s.a...U.a.u.a.j.a...V.a.d.u.c.a...V.o.l.i.s.a.....e.t.e.m.a.....i.k...g.a.....i.v.a.v.a...A.n.a.d.i.r.a...A.n.g.i.l.j.a...B.a.g.d...d.e...B.e.i.r.k.t.a...B.e.r.l.+.n.e...B.i.a.k.e.k.a...B.r.i.s.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\mer.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\mfe.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\mua.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\naq.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\nb.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15692
                                                                                                                            Entropy (8bit):5.107136461073751
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:9jZTE2gdY0qewORxHEAxmLAckJVniL3Ab8JCe7qq+E4J6BolRnbPrM2+4xt:hZTE2GjhxH1mLAJJdJg17j4YBonjYCt
                                                                                                                            MD5:FB23BA30730A5971C264F5E05FABAA72
                                                                                                                            SHA1:BFEC5F4476EB55EA95C96A2542E36A8B596E8613
                                                                                                                            SHA-256:631FA2E1E597AFCF4962EEC5B424EBEF12CE681C1B5B1D3BF879C1F6475F0996
                                                                                                                            SHA-512:2AAA89B36EE96833D57AE50FFDB288F444A1EF0AB2F325F8068137CB37DC8BF58BB0613EC13A4E5BB9973AD2D5978D7491FF5F292CACEF37FB79EB4BC1F9A9DE
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................G.. ........K...K...R...........n.pQ..T.h.i.m.p.u...T.s.j.i.t.a...A.s.o.r.e.n.e...A.c.r.e.-.t.i.d...F...r...y.e.n.e...G.u.a.m.-.t.i.d...J.a.j.a.p.u.r.a...K.o.m.o.r.e.n.e...C.a.s.e.y.-.t.i.d...L.a.n.k.a.-.t.i.d...M.a.c.a.u.-.t.i.d...M.a.l.d.i.v.e.n.e...u.k.j.e.n.t. .b.y...C.a.y.m.a.n...y.e.n.e...K.a.n.a.r.i...y.e.n.e...c.u.b.a.n.s.k. .t.i.d...A.c.r.e. .n.o.r.m.a.l.t.i.d...A.c.r.e. .s.o.m.m.e.r.t.i.d...i.r.s.k. .s.o.m.m.e.r.t.i.d...s.o.m.m.e.r.t.i.d. .. .{.0.}...A.q.t.a.u.,. .s.o.m.m.e.r.t.i.d...M.a.c.a.u.,. .s.o.m.m.e.r.t.i.d...i.r.a.n.s.k. .s.o.m.m.e.r.t.i.d...n.e.w.z.e.a.l.a.n.d.s.k. .t.i.d.....s.t.a.f.r.i.k.a.n.s.k. .t.i.d.....s.t.a.u.s.t.r.a.l.s.k. .t.i.d...A.l.m.a.t.y.,. .s.o.m.m.e.r.t.i.d...A.q.t.o.b.e.,. .s.o.m.m.e.r.t.i.d...a.r.a.b.i.s.k. .s.o.m.m.e.r.t.i.d...a.r.m.e.n.s.k. .s.o.m.m.e.r.t.i.d...a.s.o.r.i.s.k. .s.o.m.m.e.r.t.i.d...b.r.i.t.i.s.k. .s.o.m.m.e.r.t.i.d...c.u.b.a.n.s.k. .n.o.r.m.a.l.t.i.d...c.u.b.a.n.s.k. .s.o.m.m.e.r.t.i.d...j.a.p.a.n.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\nb_NO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/lcls8l:SBtkJ1li6gml/qa0
                                                                                                                            MD5:4F880C5D6BDDF339F850A87F0DC7BE2D
                                                                                                                            SHA1:90F0E7728BF802B7E962DB8434D1C562705F0613
                                                                                                                            SHA-256:B175F94ED5CE958A83AAB63677471AA4C0B2EA04FABA7C42681A5AEAEF8E5530
                                                                                                                            SHA-512:C9FC5B2F71F055D42C8501AAAAF6E6B6C290A6018CF1CFCB993735A01868850D0B3C5EAAD3A611C80D456AF9319DCF1F20CE4A8A0DB54736BA8C8D7089B54144
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ.....$..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\nd.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ne.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24584
                                                                                                                            Entropy (8bit):4.855226136028372
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mea/zju+yZRw+F23UXN9OhTq0G5CBO76HnT:m//zju+yZRJIUXN9sqzIA6HT
                                                                                                                            MD5:3963DA338F2B60544A36292CA418DF3D
                                                                                                                            SHA1:80F35F5AABC530BEF03F43094B8CBC37AFF1C481
                                                                                                                            SHA-256:BD61D131C724CC3205EF75F221F7949CD6D14D469EFA90F3C5C958676398D222
                                                                                                                            SHA-512:37735E781842F1E6AC04A3170B8AB11DA4B2AFD09585DBBD455D346C530B753EE5A5344B2581FDB9ABAFD6385ECA6A1C2F273326157A4E771C3A298CA11140ED
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .7..............D.....7.....n.pQ....0.2.....?.-.....B.....!.8.(...(.B.....2.K.....5.G.......!.>.......!.G.(.....$.>.0.....G...G.....>...>.....?.$.>...$.0.5.>...(.?.......*.2.>.....+.?...@...,.K...........>.....2.?...>...8.?.......8.?...2...9.............M.0.>.....*.?./.>.....8.M...0.....+.>.$.G.....>...0.K.....>.,.A.2.....?.0.K.-.....A...?.......A.5.G.$.....A.5.>.......>.%.>.......A...A.......A.(.?.......A.0.?.......A.(.?.8...!.>...>.0...!.G.-.?.8...$.>...*.G...&.A.,.9.@...(.>...0.A...(.>./...G...*.G.0.?.8...+.>.0.K.....,.0.(.L.2...,.?.8.>.....,.G.2.?.....,.H.........-.>.!.A.....-.?./.(.>.....(.?.2.>.....8.M...K.....>...8.(...0.?./.>.&...2.#.M.!.(...5.>.0.8.....8.>...*.(...9.-.>.(.>...9.K.-.M.!.......?.0.>.........M...>.........M...K.,.......K.0.M.8.......M...>.(.....(.A.-.?...........K.0.&.....6.A...........!.G.2.G.!.....%.G.(.M.8.....?...>.2.@.....M./.A.0.@.....A... .,.G.......>.....>.....?.0.>.(.G.....K...?./.K...!.,.M.2.?.(...!.G.(.M.-.0...!.K...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ne_IN.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):3.2808845065320833
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlQl8tSRJcls076snlPPQu/F:Sv88cROaaF
                                                                                                                            MD5:57D73A36C1932BCC70E095139AA27CFC
                                                                                                                            SHA1:B1316520907CDEFBF5E2E151B759264681C555D8
                                                                                                                            SHA-256:3DBB21BB0B9320A9ED2CC73EC1F94F96F6B39A5577F054538A21A981D1FB5F15
                                                                                                                            SHA-512:6EE871A38C28520B3D0BA288012D0265B16A9E9B40A68F463E117562EAEE348DF04F204A869D6E38930AF57193F5F07E7F035982FA7B8013E80D0E5943A06CC2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .o!...................o!....n.pQ......>........P........n!.`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\nl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22216
                                                                                                                            Entropy (8bit):4.6739069186607916
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:b4G0SJVvFTxvKlSHtCCeQWFmXJ/fWhHUdZmK3B7gcX7sVbBolYS6qrEAS2XJ:btLvFFkSNcQImZnkHGl5gcLsVbBoIOdJ
                                                                                                                            MD5:B04F1EB4EB42510211A541F8A719D410
                                                                                                                            SHA1:7B45C706D51B261825AF4475810A733A74FDBC6F
                                                                                                                            SHA-256:F4C5A3853648DD603D129293FA77A527F4CAE7D47F9259DADAA10C122FA18996
                                                                                                                            SHA-512:30305B3D15409A41B0A7605CD59750C5675CE48127C6C08BBF69C7A718D968BE995D691FEEF06BD52BD6C263F8557537EF35CC802E876D91E991006156B97DD3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ."..............L.....".3...n.pQ..C.a...r.o...P.r.a.a.g...W.e.n.e.n...A.t.1.r.a.w...P.a.r.i.j.s...B.e.r.l.i.j.n...F.a.e.r...e.r...I.r.k.o.e.t.s.k...K.h.a.r.t.o.e.m...S.j.a.n.g.h.a.i...{.0.}.-.t.i.j.d...A.c.r.e.-.t.i.j.d...A.p.i.a.-.t.i.j.d...D.o.e.s.j.a.n.b.e...H.o.v.d.-.t.i.j.d...O.m.s.k.-.t.i.j.d...A.q.t.a.u.-.t.i.j.d...C.a.s.e.y. .t.i.j.d...D.a.v.i.s.-.t.i.j.d...L.a.n.k.a.-.t.i.j.d...P.a.a.s.e.i.l.a.n.d...S.y.o.w.a.-.t.i.j.d...A.l.a.s.k.a.-.t.i.j.d...A.n.a.d.y.r.-.t.i.j.d...A.q.t...b.e.-.t.i.j.d...A.z.o.r.e.n.-.t.i.j.d...M.a.w.s.o.n.-.t.i.j.d...M.e.x.i.c.o.-.S.t.a.d...M.o.s.k.o.u.-.t.i.j.d...N.i.u.e.s.e. .t.i.j.d...S.a.m.a.r.a.-.t.i.j.d...T.a.i.p.e.i.-.t.i.j.d...V.o.s.t.o.k.-.t.i.j.d...A.m.a.z.o.n.e.-.t.i.j.d...B.e.l.a.u.s.e. .t.i.j.d...C.e.n.t.r.a.l.-.t.i.j.d...C.h.a.t.h.a.m.-.t.i.j.d...C.h.i.n.e.s.e. .t.i.j.d...C.h.u.u.k.s.e. .t.i.j.d...E.a.s.t.e.r.n.-.t.i.j.d...I.n.d.i.a.s.e. .t.i.j.d...I.r.a.a.n.s.e. .t.i.j.d...J.a.p.a.n.s.e. .t.i.j.d...M.a.c.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\nl_SR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):108
                                                                                                                            Entropy (8bit):3.3035968233312416
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlZeslvl/46lCbl/VEwg/1flPPQoNn:SvDPA6EBtTg/Xn
                                                                                                                            MD5:6DCCF108C3C097C66553C7A5E07C723B
                                                                                                                            SHA1:EC0E0B09ABADE270E9B1E8785084FC60F6AEA19C
                                                                                                                            SHA-256:C144CCA804224B9DC92C0A89431F76EA766634E8EA822A5E9DCD76D1834F8492
                                                                                                                            SHA-512:41FB6CFCEE21F0E3EE62E2911F90C1981988ECA2BE9A8E91F9236635224ABB36A77CCF98B627F0C85D1B3DF481C5BB0FDAC4BB530FF33022C83D910F973B9EC8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .o!...................o!....n.pQ..S.R.T.......p!..E#...P........n!.`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\nn_NO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/lcls8l:SBtkJ1li6gml/qa0
                                                                                                                            MD5:4F880C5D6BDDF339F850A87F0DC7BE2D
                                                                                                                            SHA1:90F0E7728BF802B7E962DB8434D1C562705F0613
                                                                                                                            SHA-256:B175F94ED5CE958A83AAB63677471AA4C0B2EA04FABA7C42681A5AEAEF8E5530
                                                                                                                            SHA-512:C9FC5B2F71F055D42C8501AAAAF6E6B6C290A6018CF1CFCB993735A01868850D0B3C5EAAD3A611C80D456AF9319DCF1F20CE4A8A0DB54736BA8C8D7089B54144
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ.....$..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\pt_AO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):176
                                                                                                                            Entropy (8bit):3.64308153590282
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlif2lnqlS2Mks9ks9ks9ksWbjkgl1IrSMbhot:SvVq0NTTTAg2Mb6t
                                                                                                                            MD5:0314889A62D29F92898F2E84FB0D88D6
                                                                                                                            SHA1:5E274DBBD7F357AD6D09B3B822A4B92D3109C8B4
                                                                                                                            SHA-256:C1991718A07AEFC99FB6206F3BC6C99AFA7FF678E9F6A01B4A475DDC2B288B23
                                                                                                                            SHA-512:04B0C28F2BA9CC19A5A89D0946050C41874617F8EC2CB3C1F268931446AF51C4B3850F4A3A627E14EB34C504435F726CC4F8B11733FCC5F2D73EF2371BACB1CD
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .o!.....$...$.........o!....n.pQ................................................................A.U........P...P...P...P..^%.......`n!.`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\pt_CH.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):2.981496329528674
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM8l3qllMBE:SvdqsBE
                                                                                                                            MD5:F296D3FCC79936E98F21165E870D5D2C
                                                                                                                            SHA1:E80750375415F9D975F3B372A3926EDEE0171024
                                                                                                                            SHA-256:C340243D5A2B7FD6DA05EBB7113DC4A516FF4F02CBAA48CAF1E7EF5ACA0BAAFA
                                                                                                                            SHA-512:AF8D4F6D49D618CAB159DDA4E545B94CDBBE8E7E8C9C87B4CEFD9A7D8103B7F0634A06B02DBA23378A8DBC43B431E8509CE42C6FBAD15D21A0CEB639D25F3D9A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.o!...................o!....n.pQ....^%....n!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\pt_GQ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):2.981496329528674
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM8l3qllMBE:SvdqsBE
                                                                                                                            MD5:F296D3FCC79936E98F21165E870D5D2C
                                                                                                                            SHA1:E80750375415F9D975F3B372A3926EDEE0171024
                                                                                                                            SHA-256:C340243D5A2B7FD6DA05EBB7113DC4A516FF4F02CBAA48CAF1E7EF5ACA0BAAFA
                                                                                                                            SHA-512:AF8D4F6D49D618CAB159DDA4E545B94CDBBE8E7E8C9C87B4CEFD9A7D8103B7F0634A06B02DBA23378A8DBC43B431E8509CE42C6FBAD15D21A0CEB639D25F3D9A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.o!...................o!....n.pQ....^%....n!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\pt_MO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):176
                                                                                                                            Entropy (8bit):3.64308153590282
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlif2lnqlS2Mks9ks9ks9ksWbjkgl1IrSMbhot:SvVq0NTTTAg2Mb6t
                                                                                                                            MD5:0314889A62D29F92898F2E84FB0D88D6
                                                                                                                            SHA1:5E274DBBD7F357AD6D09B3B822A4B92D3109C8B4
                                                                                                                            SHA-256:C1991718A07AEFC99FB6206F3BC6C99AFA7FF678E9F6A01B4A475DDC2B288B23
                                                                                                                            SHA-512:04B0C28F2BA9CC19A5A89D0946050C41874617F8EC2CB3C1F268931446AF51C4B3850F4A3A627E14EB34C504435F726CC4F8B11733FCC5F2D73EF2371BACB1CD
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .o!.....$...$.........o!....n.pQ................................................................A.U........P...P...P...P..^%.......`n!.`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\pt_MZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):176
                                                                                                                            Entropy (8bit):3.64308153590282
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlif2lnqlS2Mks9ks9ks9ksWbjkgl1IrSMbhot:SvVq0NTTTAg2Mb6t
                                                                                                                            MD5:0314889A62D29F92898F2E84FB0D88D6
                                                                                                                            SHA1:5E274DBBD7F357AD6D09B3B822A4B92D3109C8B4
                                                                                                                            SHA-256:C1991718A07AEFC99FB6206F3BC6C99AFA7FF678E9F6A01B4A475DDC2B288B23
                                                                                                                            SHA-512:04B0C28F2BA9CC19A5A89D0946050C41874617F8EC2CB3C1F268931446AF51C4B3850F4A3A627E14EB34C504435F726CC4F8B11733FCC5F2D73EF2371BACB1CD
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .o!.....$...$.........o!....n.pQ................................................................A.U........P...P...P...P..^%.......`n!.`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ro.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):23516
                                                                                                                            Entropy (8bit):4.552049322327995
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:hpEGbjU41qS/99gByDR0ARPS4Q2wt5aCKLiBoVyY:DJH64Q2wn2Lo+
                                                                                                                            MD5:54208A5849F9D7A1CD280C6A82C6D4FB
                                                                                                                            SHA1:190A5142210A28B571BAE971BD8B9670E30F060D
                                                                                                                            SHA-256:8B2F3EDF22821BAE7D5A6761E61B46929A95CC8CCBA1E05F61A3D9509F95119F
                                                                                                                            SHA-512:9DC00FD02E2E0F6254BE04AC65D856AF661F34408F7DB369DE2D3EEF864683C372E27C0DA84A1B869DDC48721C177B2A2C1E942D2B1B93609958B008E32FA80C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ."..............I.....".}...n.pQ..C.i.t.a...A.t.e.n.a...A.l.m.a.t.....A.t...r.a.u...B.i...k.e.k...C.a.n.a.r.e...D.a.m.a.s.c...K.u.w.e.i.t...A...g.a.b.a.t...D.u...a.n.b.e...M.o.s.c.o.v.a...P.h.e.n.i.a.n...T.a...k.e.n.t...U.j.h.o.r.o.d...O.r.a. .A.c.r.e...V.a.r...o.v.i.a...Z.a.p.o.r.o.j.e...B.u.d.a.p.e.s.t.a...G.u.a.d.e.l.u.p.a...H.o. ...i. .M.i.n...I.e.r.u.s.a.l.i.m...K.a.m.c.i.a.t.k.a...O.r.a. .C.u.b.e.i...O.r.a. .a.r.a.b.....S.f... .E.l.e.n.a...I.n.s.u.l.a. .M.a.n...O.r.a. .C.h.i.n.e.i...O.r.a. .C.o.r.e.e.i...O.r.a. .I.n.d.i.e.i...N.o.v.o.k.u.z.n.e...k...O.r.a. .d.i.n. .{.0.}...O.r.a. .A.r.m.e.n.i.e.i...O.r.a. .B.o.l.i.v.i.e.i...O.r.a. .G.e.o.r.g.i.e.i...O.r.a. .I.r.a.n.u.l.u.i...O.r.a. .J.a.p.o.n.i.e.i...O.r.a. .M.o.s.c.o.v.e.i...O.r.a. .d.i.n. .A.p.i.a...O.r.a. .d.i.n. .F.i.j.i...O.r.a. .d.i.n. .H.o.v.d...O.r.a. .d.i.n. .N.i.u.e...O.r.a. .d.i.n. .O.m.s.k...O.r.a. .d.i.n. .P.e.r.u...O.r.a. .B.r.a.s.i.l.i.e.i...O.r.a. .C.o.l.u.m.b.i.e.i...O.r.a. .N.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\se_FI.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14992
                                                                                                                            Entropy (8bit):4.205931100903372
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:rO2AQ2/BEPDnNluF7Mwv+orW27MuEAxVcTyovG:a2AQ2/BEPDNlSwwvhrr7yTyD
                                                                                                                            MD5:305060097964078359699857BACD82C4
                                                                                                                            SHA1:6DD6F95BEACF2940B01859877A93739C5F2DF026
                                                                                                                            SHA-256:936A9046CBD208EDE26D0EB4CB0AFCA088985D52129F67C1BADA1DC692A5034D
                                                                                                                            SHA-512:88A65EF7BEE1C82C89C407349310F4FFDB0925ED421C8551AB49BA3E38F317643F3A7EBD4F0A08980405DF228D3E3A0EF445922B61CE265F117F6539ED71ACC0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ........................q...n.pQ..A.z.o.r.a.t...J.a.k.u.c.k...H.e.l.s.s.e.t...K.a.n...r.i.a...W.a.r.s.a.w.a...D.a.m.a.s.k.o.s...M.a.n.s.u.o.l.u...A.p.i.a. ...i.g.i...C.u.b.a. ...i.g.i...F.i.j.i. ...i.g.i...L.u.x.e.n.b.u.r.g...P.e.r.u. ...i.g.i...C.h.i.l.e. ...i.g.i...H.o.v.d.a. ...i.g.i...I.r.a.n.a. ...i.g.i...K.o.r.e.a. ...i.g.i...N.a.u.r.u. ...i.g.i...N.i.u.e.a. ...i.g.i...O.m.s.k.a. ...i.g.i...S.a.m.o.a. ...i.g.i...S.y.o.w.a. ...i.g.i...T.o.n.g.a. ...i.g.i...A.l.a.s.k.a. ...i.g.i...A.r...b.i.a. ...i.g.i...C.h.u.u.k.a. ...i.g.i...D.a.v.i.s.a. ...i.g.i...J.a.p...n.a. ...i.g.i...J.u.o.v.l.a.s.u.o.l.u...K.i.i.n.n... ...i.g.i...M.a.l.e.d.i.i.v.v.a.t...M.a.r.q.u.e.s.a.s.a.t...M.o.s.k.v.a. ...i.g.i...N.e.p.a.l.a. ...i.g.i...N.o.v.o.k.u.s.n.e.c.k...P.a.l.a.u.a. ...i.g.i...P.o.n.a.p.e. ...i.g.i...T.a.h.i.t.i. ...i.g.i...T.u.v.a.l.u. ...i.g.i...A.m.a.z.o.n.a. ...i.g.i...A.r.m.e.n.i.a. ...i.g.i...A.z.o.r.a.i.d. ...i.g.i...B.h.u.t.a.n.a. ...i.g.i...B.o.l.i.v.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\shi_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.0064963295286735
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsbxl9illM96:SvOwisY
                                                                                                                            MD5:CA8B438F4E17056EF5FCEFC231433AA5
                                                                                                                            SHA1:344346EB61A633E5075E40206F6ABEC7EA930F4C
                                                                                                                            SHA-256:633ABCC57CE9C650409448B097E913DBB7C0A47A7FC9ADC552B1FB9679EB64E7
                                                                                                                            SHA-512:37996B08968548E85165343C1F664A20899B0F9EFCC1C37845BC35E9EF8D9E69DD02747D99245493E006973454FFB8C3708B4D0A439A92D5132A10750343BB0D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ....^%....R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\shi_Tfng.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\si.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):28804
                                                                                                                            Entropy (8bit):4.8037122129403205
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:BtaMCsiftfEWjqoB8z4x4JFbTSxua9lXzGIICMqfBOvxHp:jaMtw5qoB8zw8bTh6DGIsm03
                                                                                                                            MD5:B0D1B01BC5142182E56BB88EFCD1792E
                                                                                                                            SHA1:BD0CA25D62FC4101C148666E4DEB2A53CEF8C6AF
                                                                                                                            SHA-256:59C6FE8C2D4E270CA4E8F18D5153E81CE7687FC07D66A353DCA38D8DC1FD1338
                                                                                                                            SHA-512:1D4727B85CCAE3D002850D3792EAD55D0D9160A7674BD718DFF449017E06EEE499FE8D2EF95837308AC6F8A005F9C4AEC813A1F35C50C3871320B396AB7350E6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..H.............E......H....n.pQ....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sl.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):21756
                                                                                                                            Entropy (8bit):4.682056859194047
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:4vFmDWcp+9IrHu+Uu/GuZf9o7h9mfBIaBOBNDgm:4UDebQXZfsh9UBIwqDgm
                                                                                                                            MD5:28AF7AE04C85237773049449E01F2692
                                                                                                                            SHA1:EB5CB4FDD13DEB69131C170160CEB8851EBB01C3
                                                                                                                            SHA-256:EE1E1DF9FB0C5757C4ED94F40DCE1BB5F30887DB66D9155F8D692708EFCEA9B0
                                                                                                                            SHA-512:D81B0363866B50AFCCF715F89CEFBB17BB4A5167A5C628C25E778DE8DFC2381D1A695A86163EC9A1A480FCFDBC73DD419266A60AEB9C170D1F6096C9E7774B61
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................3.. ."......7...7...G.....".....n.pQ..A.t.e.n.e...D.u.n.a.j...K.o.m.o.r.i...M.u.a.k.a.t...B.e.r.m.u.d.i...B.r.u.s.e.l.j...L.i.z.b.o.n.a...{.0.}. ...a.s...H.o.a.i.m.i.n.h...K.i.z.l.o.r.d.a...O.t.o.k. .M.a.n...B.u.k.a.r.e.a.t.a...K...b.e.n.h.a.v.n.....a.s.:. .A.p.i.a...G.o.r.s.k.i. ...a.s.....a.s.:. .D.a.v.i.s.....a.s.:. .S.y.o.w.a.....i.l.s.k.i. ...a.s...A.l.j.a.a.k.i. ...a.s...A.r.a.b.s.k.i. ...a.s...A.z.o.r.s.k.i. ...a.s...H.o.v.d.s.k.i. ...a.s...I.r.a.n.s.k.i. ...a.s...V.z.h.o.d.n.i. ...a.s...A.r.m.e.n.s.k.i. ...a.s...B.o.~.i...n.i. .o.t.o.k...B.u.t.a.n.s.k.i. ...a.s...J.a.p.o.n.s.k.i. ...a.s...K.i.t.a.j.s.k.i. ...a.s...K.o.r.e.j.s.k.i. ...a.s...K.u.b.a.n.s.k.i. ...a.s...N.e.p.a.l.s.k.i. ...a.s...N.i.u.e.j.s.k.i. ...a.s...P.a.l.a.v.s.k.i. ...a.s...P.e.r.u.j.s.k.i. ...a.s...P.o.n.a.p.s.k.i. ...a.s...S.a.m.a.r.s.k.i. ...a.s...V.o.s.t.o.a.k.i. ...a.s.....a.t.a.m.s.k.i. ...a.s...A.m.a.z.o.n.s.k.i. ...a.s...A.n.a.d.i.r.s.k.i. ...a.s...A.t.l.a.n.t.s.k.i. ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sr_Latn_ME.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/lcls8l:SBtkJ1li6gml/qa0
                                                                                                                            MD5:4F880C5D6BDDF339F850A87F0DC7BE2D
                                                                                                                            SHA1:90F0E7728BF802B7E962DB8434D1C562705F0613
                                                                                                                            SHA-256:B175F94ED5CE958A83AAB63677471AA4C0B2EA04FABA7C42681A5AEAEF8E5530
                                                                                                                            SHA-512:C9FC5B2F71F055D42C8501AAAAF6E6B6C290A6018CF1CFCB993735A01868850D0B3C5EAAD3A611C80D456AF9319DCF1F20CE4A8A0DB54736BA8C8D7089B54144
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ.....$..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sr_Latn_YU.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.95862347711418
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM7t66E7l3lPclspK:Svk06g3lkapK
                                                                                                                            MD5:514CBEF4886D54AED23144B3AA05EDAF
                                                                                                                            SHA1:F442A0E8F56D355AB8522DF0BBEC1CECE89BF781
                                                                                                                            SHA-256:96D1D9268B17D977DCB132AD277E8455A59B0C6DDAC7AB3117BC85994E4B1C97
                                                                                                                            SHA-512:86377B2655874404E292B3F3EE869CCFBCD930002FC65CE291587A9B75D7BCF6A1F29EC5AD6264D25DEF534CB39EED0967CC8C4A87316C5C6CD3A73E4F165DF8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P../..................../....n.pQ.....$./

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sr_ME.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.925547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/qli16lLMA+GIPn:SBtkJYlU8g8l/qk16JAGy
                                                                                                                            MD5:0603FC86A4027231623B2CBDBF29364E
                                                                                                                            SHA1:AB307EB3EA3DE97CF414C2F262431D6D8891196B
                                                                                                                            SHA-256:06B72F72F727D3340FBCB8E5B1016B5F8D49B84A78BFF39A95B4F0E7BFE1BFB4
                                                                                                                            SHA-512:97555480587963BCF964D37048A7E388C6885726565F966159474846E9B8560B449509783637AACF290472C85C39A70B86E6C1F6A35BC494DCCAFE533490B355
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ..s.r._.L.a.t.n._.M.E......$....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sr_RS.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.9849392665878645
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMWEi6E7lDJcls0:Svvt6gDOa0
                                                                                                                            MD5:7A74FC755D1E0D6D48CD5B4C2361592B
                                                                                                                            SHA1:F35EE9E8B2B8AD42D48265AB5F32617B664A77FE
                                                                                                                            SHA-256:028A167D99B424B29176736EAFD35631BACF7A4F087E765C6E244CEF0D12203E
                                                                                                                            SHA-512:BE38F81FE8D53B9FA2ADAD5D2B403DAE7E6223F6AA4438F5DDD5C3BE3B88795A720E90197A96263DC8251ABC10F96A7C5E987DBEA84A00CB88F60394278F54F6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.J/...................J/....n.pQ.....$I/

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sv.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):19576
                                                                                                                            Entropy (8bit):4.816887587208837
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:LebdlpyruH/MtVTcYXmHxvfy/wxdrYRmxi62Q3Qzc7sBo33zR:LebdTsufMtVA1xv32zmii1
                                                                                                                            MD5:47F8199400ABE079A5E142835EE078CC
                                                                                                                            SHA1:2A405F29574126B2D977933EE9B9E22824BF1D6F
                                                                                                                            SHA-256:243E93F98403EF1220E25D26978C812B8BDE2DCAD9F23A6A488C5C4D553750D9
                                                                                                                            SHA-512:AD86AA297663821A6AF615C0834D1ACCFDFF61455A0604B94CB04A3224CF02FA07F55C61EB7C16868616A28A48493EE00E6D48880344707B06B709F8A245C431
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ."..............R.....".....n.pQ..S...u.l...C.h.o.v.d...J.u.l...n...T.j.i.t.a...P...s.k...n...{.0.}.t.i.d...A.p.i.a.t.i.d...B.r.y.s.s.e.l...F.i.j.i.t.i.d...G.u.a.m.t.i.d...N.i.u.e.t.i.d...O.m.s.k.t.i.d...A.q.t.a.u.t.i.d...A.z.o.r.e.r.n.a...C.a.s.e.y.t.i.d...C.h.o.v.d.t.i.d...C.h.u.u.k.t.i.d...D.a.v.i.s.t.i.d...E.l.-.A.a.i...n...M.a.c.a.o.t.i.d...N.a.u.r.u.t.i.d...P.a.l.a.u.t.i.d...P...s.k...t.i.d...S.y.o.w.a.t.i.d...T.o.n.g.a.t.i.d...T.o.r.s.h.a.m.n...W.a.l.l.i.s...n...2...1...4.8...9.0...A.l.a.s.k.a.t.i.d...A.l.m.a.t.y.t.i.d...A.n.a.d.y.r.t.i.d...A.q.t...b.e.t.i.d...B.r.u.n.e.i.t.i.d...K.o.m.o.r.e.r.n.a...K.o.s.r.a.e.t.i.d...K...p.e.n.h.a.m.n...M.a.w.s.o.n.t.i.d...M.o.s.k.v.a.t.i.d...P.o.n.a.p.e.t.i.d...S.:.t. .J.o.h.n.s...S.:.t. .K.i.t.t.s...S.:.t. .L.u.c.i.a...S.a.m.a.r.a.t.i.d...T.a.h.i.t.i.t.i.d...T.a.i.p.e.i.t.i.d...T.u.v.a.l.u.t.i.d...V.a.t.i.k.a.n.e.n...V.o.s.t.o.k.t.i.d...C.h.a.t.h.a.m.t.i.d...G.a.m.b.i.e.r.t.i.d...I.r.k.u.t.s.k.t.i.d...J.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\ta_MY.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):124
                                                                                                                            Entropy (8bit):3.509365217027279
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlufLm8ROls0+lsalusvzvGl1lllPPQr/F:Svwm8ROaRusvzOvl2/F
                                                                                                                            MD5:31352977E2AA647E46057625746FF873
                                                                                                                            SHA1:9B7EBA98417759D2F37FAAE5EE319958172B3CDA
                                                                                                                            SHA-256:F7321619D91853F3362BA7193EAA013F70E76802536DEA28359389FE7944E9D0
                                                                                                                            SHA-512:B921153F47A755A6BDB7B7CF932A77494941A3CD0AEF88CD3E38A9E7B3F61A01232DE159E481D9FA3987FB0221BA606AB3742862F87AFDD56C26476A37F9FBDA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .o!...................o!....n.pQ............;.....K...... .#...P...P...P........n!.`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\twq.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMnsct6E7lE/3Vcls/36n:SvOnt6gA6a/K
                                                                                                                            MD5:264C63861CEEF0E1A4CC72D014AA43FC
                                                                                                                            SHA1:74B6AAFBFE5D4DCE23EC1950246D948A8AF12CEF
                                                                                                                            SHA-256:2C7E3796404241F7FF344F6E838EB3DFB77569152BFEB1880927E4347B50C642
                                                                                                                            SHA-512:A65E31C1FA603F4A893236A84D56B04A9563E8A9520100839A997C62A2D749C3A47FF862F195D8C731194F1E9FFA9D7112214E6D3C06FAC5C940A26611217B9B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.S....................S.....n.pQ......R.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\uz.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24288
                                                                                                                            Entropy (8bit):4.554695048412468
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:RT8tBfUI7LLNfYyVPlRAJ3hNT3o2jauVEtE256UGpQTKin2gYFs40lplr5FKwyE+:lIfUI7fNfYyVPlRAJ3hNT3o+a5tE256z
                                                                                                                            MD5:D46047BA9245966FC8B99F2632FC2977
                                                                                                                            SHA1:80F44E7EE033540E67131B6F2AE1F412C3D43DD2
                                                                                                                            SHA-256:C837DEA1D261BF66F36487B31E5361FA764415ED567C9B9F55C979C47C0DCF15
                                                                                                                            SHA-512:969173DF74EECDA597607BD686D0AA0D94435B5E1577029091BBF7944F42400986B85F5667CB40B57CCAFB94D294CD9867B8F177CBD1349E5389863114CF31B8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ._..............D....._.E...n.pQ..M.a.e...A.d.a.n...B.o.k.u...J.u.n.o...V.e.n.a...X.o.v.d...A.f.i.n.a...A.m.m.o.n...B.a.i.y.a...E.v.k.l.a...G.. a.z.o...J.e.r.s.i...K.e.r.r.i...K.e.y.s.i...K.i.y.e.v...O.q.t.o.v...P.a.r.i.j...Q.o.b.u.l...S.y.o.v.a...B.a.y.r.u.t...B.r.u.n.e.y...D.e.y.v.i.s...G.a.v.a.n.a...G.a.y.a.n.a...G.e.r.n.s.i...G.o.t.x.o.b...J.a.y.p.u.r...J.a.z.o.i.r...K.u.y.a.b.a...L.a.-.P.a.s...M.a.p.u.t.u...M.a.s.e.y.o...O.k.l.e.n.d...Q.o.h.i.r.a...Q.u.d.d.u.s...Q.u.v.a.y.t...S.a.y.p.a.n...S.k.o.p.y.e...S.y.u.r.i.x...T.a.y.p.e.y...T.e.h.r.o.n...V.a.d.u.t.s...X.a.r.a.r.e...X.a.r.t.u.m...X.e.v.r.o.n...X.o.b.a.r.t...A.l.-.A.y.u.n...A.n.g.i.l.y.a...A.n.k.o.r.i.j...A.s.u.n.s.o.n...B.a.g.. d.o.d...B.a.h.r.a.y.n...B.r.i.s.b.e.n...C.h.i.k.a.g.o...D.a.m.a.s.h.q...D.e.t.r.o.y.t...G.o.n.k.o.n.g...G.u.s.-.B.e.y...J.o.n.s.t.o.n...K.a.y.e.n.n.a...L.o.n.g.y.i.r...M.a.y.o.r.k.a...N.a.y.r.o.b.i...N.o.r.o.n.y.a...O.q.t.o.. b.a...O.x.i.n.a.g.a...P.n.o.m.p.e.n...P.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\uz_Latn.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMn6E7l2RJcls/LEn:Svm6g2ROa/w
                                                                                                                            MD5:CBF1E43602D294E22F60CDEFFFBE1133
                                                                                                                            SHA1:E9B337C3EE0C3FE63B741FAA70A51FB5A8475970
                                                                                                                            SHA-256:968F1197DF1B8B6F2FF8113B28253086818EA2C8E21C049509DC10D50ADEB7F8
                                                                                                                            SHA-512:66979D342BEBA1C32521F3797499C19FA3895E8EFE74AE6E50CAAC65AA72B282180BB3BE55AD6B4A479C393E992F88F0F12B4D2B5429FEFD5681076D519041EB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.o!...................o!....n.pQ......n!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\uz_UZ.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):100
                                                                                                                            Entropy (8bit):2.945547915629603
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlDklU8gl8l/qlwfglwl3l/yPn:SBtkJYlU8g8l/q+fgK/c
                                                                                                                            MD5:ED70BEABDBA235CE58329F8207310ACA
                                                                                                                            SHA1:5CA4DD0342660519C47EA266536E2B25490F394F
                                                                                                                            SHA-256:BDD363B832BC4A953FF0EB4889AE2CC4E15BFBC941B9B6867B33AC5B004249F0
                                                                                                                            SHA-512:944FD804B9FE6D5639B55FE67478B9332F2518F1624278E59D4190C019F210AE1004466ED861E65014A0B51D988A5BA507671D5FC105E07049F7571DD301DD0B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ..u.z._.L.a.t.n._.U.Z......$....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\vai_Vaii_LR.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/lcls8l:SBtkJ1li6gml/qa0
                                                                                                                            MD5:4F880C5D6BDDF339F850A87F0DC7BE2D
                                                                                                                            SHA1:90F0E7728BF802B7E962DB8434D1C562705F0613
                                                                                                                            SHA-256:B175F94ED5CE958A83AAB63677471AA4C0B2EA04FABA7C42681A5AEAEF8E5530
                                                                                                                            SHA-512:C9FC5B2F71F055D42C8501AAAAF6E6B6C290A6018CF1CFCB993735A01868850D0B3C5EAAD3A611C80D456AF9319DCF1F20CE4A8A0DB54736BA8C8D7089B54144
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ.....$..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\wae.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1564
                                                                                                                            Entropy (8bit):4.555311598702862
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:EJhy5pG0kRHp5uKu5wyu5Guhu5zF2u02uFjh2u0jhjPkHHBXgsKs:uhyZkBp565wf5GuU5zgu9u18uWRPknpB
                                                                                                                            MD5:C3FD8EEAD516A6FDCBC4F005EDDFAAF9
                                                                                                                            SHA1:F857BABC9B5922075AEE7D53E3B4A1DBFC67D5C3
                                                                                                                            SHA-256:4C974E2311222AC517CFE86D7F3573E1726563868CCEB02B2869B905527F68CF
                                                                                                                            SHA-512:2BF54B5D8A3B0C24AEBC6591CB8173660DAAE9B80870C89E08F98C1E2E72A6E388C17BED95DF2BD36D27D159E056D9499CA61F0416E8AD29617F372FC61E4840
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................{.. ................-.......7...n.pQ..R.e.v.a.l...T.i.r.a.n...Z...r.i.....L.a.i.b.a.....S.i.d.n.e.i...W.a.r.a.a.u...D.a.i.b.u.t.i...H.a.w.a.n.n.a...{.0.}. .z.i.t...B.u.d.a.p.e.a.t...B.u.k.a.r.e.a.t...K.o.p.e.h.a.g.e...M.o.n.s.e.r.a.t...R.i.k.j.a.w.i.k...A.m.a.t.e.r.d.a.m...K...n.i.g.s.b...r.g...K.a.i.m.a.n.i.n.s.l.a...A.t.l.a.n.t.i.a.i. .Z.i.t...K.o.n.a.t.a.n.t.i.n.o.p.e.l...O.a.t.e.u.r.o.p...i.a.i. .Z.i.t...U.n.b.e.k.a.n.n.t.i. .S.t.a.d.t...W.e.a.t.e.u.r.o.p...i.a.i. .Z.i.t...A.t.l.a.n.t.i.a.i. .S.u.m.m.e.r.z.i.t...M.i.t.t.e.l.e.u.r.o.p...i.a.i. .Z.i.t...A.t.l.a.n.t.i.a.i. .S.t.a.n.d.a.r.d.z.i.t...O.a.t.e.u.r.o.p...i.a.i. .S.u.m.m.e.r.z.i.t...W.e.a.t.e.u.r.o.p...i.a.i. .S.u.m.m.e.r.z.i.t...O.a.t.e.u.r.o.p...i.a.i. .S.t.a.n.d.a.r.d.z.i.t...M.i.t.t.e.l.e.u.r.o.p...i.a.i. .S.u.m.m.e.r.z.i.t...W.e.a.t.e.u.r.o.p...i.a.i. .S.t.a.n.d.a.r.d.z.i.t...M.i.t.t.e.l.e.u.r.o.p...i.a.i. .S.t.a.n.d.a.r.d.z.i.t.....#.....#.....#.....#."...#.....#.j...#.....#.n...#.|...#.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\wo.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1888
                                                                                                                            Entropy (8bit):4.031767224099958
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:9fMHKzH51PKEwdevOMuZNMEEggv5JkKFXyErIKFcKjM1KF5Q8gKMEg1auVaEEg1Q:xMqzZ1PKEw4mM8NMEEggxJkeyErIZEMI
                                                                                                                            MD5:B0F769E5129E8F6FB422F06F87C3AB4D
                                                                                                                            SHA1:11D9DE49352A932DCEEDC8ED3ED62FFE3A62FB29
                                                                                                                            SHA-256:26070309EABA6283EE84AD1F10AA40C6BB36939720490D305094EC411AAEEE88
                                                                                                                            SHA-512:1C46E0CAC402A344BF65B3F7295C36475D5A9792F3C94A7341AB5F91DC0B44E7BDB04B039CE119625CD209428AF308FBE7EF1204760D9AAB7ADC614B45F91B6E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .lG...................lG....n.pQ..2...1...4.7...8.4...D...k.k. .b.u... .x.a.m.u.l...E.T. .w.a.x.t.u. .p.e.n.k.u...M.T. .(.w.a.x.t.u. .t.u.n.d.u.)...P.T. .(.w.a.x.t.u. .p.a.s.i.f.i.k.)...A.T. .(.w.a.x.t.u. .a.t.l...n.t.i.k.)...C.T. .(.w.a.x.t.u. .s...n.t.a.r.a.l.)...G.M.T. .(.w.a.x.t.u. .G.r.e.e.n.w.i.c.h.)...E.D.T. .(.w.a.x.t.u. .b...c.c...g.u. .p.e.n.k.u.)...E.E.T. .(.w.a.x.t.u. ...r.o.o.p. .u. .p.e.n.k.u.)...M.D.T. .(.w.a.x.t.u. .b...c.c...g.u. .t.u.n.d.u.)...C.T.E. .(.w.a.x.t.u. ...r.o.o.p. .s...n.t.a.r.a.a.l.)...P.D.T. .(.w.a.x.t.u. .b...c.c...g.u. .p.a.s.i.f.i.k.)...A.D.T. .(.w.a.x.t.u. .b...c.c...g.u. .a.t.l...n.t.i.k.)...A.S.T. .(.w.a.x.t.u. .e.s.t...n.d.a.a.r.u. .p.e.n.k.u.)...C.D.T. .(.w.a.x.t.u. .b...c.c...g.u. .s...n.t.a.r.a.a.l...E.S.T. .(.w.a.x.t.u. .e.s.t...n.d.a.a.r.u. .p.e.n.k.u.)...M.S.T. .(.w.a.x.t.u. .e.s.t...n.d.a.a.r.u. .t.u.n.d.u.)...W.E.T. .(.w.a.x.t.u. ...r.o.o.p. .u. .s.o.w.w.u.-.j.a.n.t...P.S.T. .(.w.a.x.t.u. .e.s.t...n.d.a.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\yi.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):308
                                                                                                                            Entropy (8bit):4.212503743247875
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:SvMppagg8z9sk141A6YEgFW4g9VFig9zwi4uyNOlwl+oD:bpReVYJkPVFh6NOKEC
                                                                                                                            MD5:3912F22AB65F8E1F7A473ACCCD9CAC9C
                                                                                                                            SHA1:E770D84AAF2CEA9CEF79D6B1224C37FEB7FCCF00
                                                                                                                            SHA-256:186E5766A194471B751F5F6A9AB765C4AD018BE5B8C614A18AE55A3E9F55F77B
                                                                                                                            SHA-512:2C10C046FC16DCB6C8ED8DFDA415F32459C3B2D8129628A08753A90AEDCBE64D4CF12E3E33AB0BB36381836727D23438F8BB9F1ACFFE4C7CE837B2D3A907C6DC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................A.. .S......E...E.........S.7...n.pQ.............................................................................. ....... ....... ....................................... ...............#.m...#.c...#.T...#.Z...#.x...#.......U...(.......J..PM..PP..PS..PV..PY..P........R..`7..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\yue_Hans.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15400
                                                                                                                            Entropy (8bit):6.307867960323765
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:3+mefvINl2pgObqu3C1CZkmAcOByfGeGfSThtKMxBoV56M:3+TneaC4+BmmfSFtKIIn
                                                                                                                            MD5:8A2CF03BFE78EAED966EE45E0D04778F
                                                                                                                            SHA1:68C5F7D4DE40AD3B5DF40CC13091B93FA8013880
                                                                                                                            SHA-256:63F81ADCEE5E33538E9164D748A304D94D618AD100D0F7A8A61D305035FA1002
                                                                                                                            SHA-512:C9672636627DFF6FF60D8AEABDD7F7AC84A529E4024CA8CA1ED6BB70689E4EC79EA819A3BECB0FECF918B9E95A25D9FCD228CBFBDB570D3BDE8955B6DC7ECB26
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..S.............Q......S....n.pQ...N.N..9N[O...N.N...NIQ...O....&Ofe../O.e..KQ...sQ.\...Q....)Rl....R(....RKQ..NS.l..aS.....SKf..NW.f..dW8u...W....TX.g..^X.s...ZKQ...[.f...].^...].g...]....^.....^.t...^.R..s^.X...^.^..._.N..._W....b"}...eNm...f.\...f7...1g.]..\g.b..\g....gfW..ZiKQ...k.~..8l.s..vl.....l.Y...m.....s.T...s.z...~.~...~.\..W.l......h.....Y..........&O..d.TX....aS..S..h....R........xQ...h.....\..E.~n..l.1g....-N...\..LN.b.\..TN.]q\...N~g.h..pQ.N~n...Q.Q.W..)R.._..QReh~n...R.~)R..bS.h!X...S..]...S&OaW...SfW)R...S.)n...T.^0W...T.^.f...T.YNS...U.^.\...U.b....#W.OW...#W.W(...#WTX&O..#W.Y....#W.e.h..#W.~....#W.[..#W..\..#W..f..*X0W.R...X.\,g...X.],g...Y;m.\...Y&O.Y..'Y.n0W..GYNSNS..GY..Yt..HY.m.k..eYKQpQ..eY.eF....[.T.b...[0WaS...[S..\...[/T.N..<\.N....<\.v.Q...].O?....].bl....]<h.....]...Y...]l..y...^.b"}...^u..\..:_.e....._.pQ..4b.~.e...b.T.e...beu.T...cNS.~..id.~.T..\gQh....9ho`.\..<hpQ:W...h......h...Q...lpQ/n...ll..b...l.~

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\yue_Hant.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMn6E7l2RJcls/LEn:Svm6g2ROa/w
                                                                                                                            MD5:CBF1E43602D294E22F60CDEFFFBE1133
                                                                                                                            SHA1:E9B337C3EE0C3FE63B741FAA70A51FB5A8475970
                                                                                                                            SHA-256:968F1197DF1B8B6F2FF8113B28253086818EA2C8E21C049509DC10D50ADEB7F8
                                                                                                                            SHA-512:66979D342BEBA1C32521F3797499C19FA3895E8EFE74AE6E50CAAC65AA72B282180BB3BE55AD6B4A479C393E992F88F0F12B4D2B5429FEFD5681076D519041EB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.o!...................o!....n.pQ......n!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\yue_Hant_HK.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.500123730064915
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVTtkJtlMeli6E7lml/lcls8l:SBtkJ1li6gml/qa0
                                                                                                                            MD5:4F880C5D6BDDF339F850A87F0DC7BE2D
                                                                                                                            SHA1:90F0E7728BF802B7E962DB8434D1C562705F0613
                                                                                                                            SHA-256:B175F94ED5CE958A83AAB63677471AA4C0B2EA04FABA7C42681A5AEAEF8E5530
                                                                                                                            SHA-512:C9FC5B2F71F055D42C8501AAAAF6E6B6C290A6018CF1CFCB993735A01868850D0B3C5EAAD3A611C80D456AF9319DCF1F20CE4A8A0DB54736BA8C8D7089B54144
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P............................n.pQ.....$..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\zh.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):16120
                                                                                                                            Entropy (8bit):6.334477949772806
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:Q9fhn8/bDuVja1f3SLmACG+NsIN53YOJiBoIT/O19e5:Yfh8GVwCpCII3/odqne5
                                                                                                                            MD5:9AACAB1B7BC93CE38E27EDFE0A9FC386
                                                                                                                            SHA1:CDDF34A9738E2C73A904CDC7FD2C44920EEB9994
                                                                                                                            SHA-256:016EF8A44579E8BDA42A0E2F6B65A7D44F0C8BDB1E270273DA4A2F7FFDB047B3
                                                                                                                            SHA-512:F393371C49DA797435867E406AE26DC5FACD040F13A5696BF1F8DB5AF354509F0562C18A0E4EDA3B7125F2EEC2516076E94766310E2468BE13770F86E5D900FA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ..S.............R......S6...n.pQ...Na....N.N..9N[O...N.N...NIQ...O....&Ofe..sQ.\..)Rl....R.l...RKQ..NS.l..aS^X..aS.[...SKf...V.R..NW.f..dW8u...W....TX.g..^X.s...ZKQ...[.f...].^...].g...]....^.R...^.R..s^.X...^)R...^.^..._.f..._W....`<\...b.....e.....eNm..-f.T...f.\...f7...1g.]..1g.....k.~...lW....m.....o....s.e...s.T..Yt.....~.W...~.~..W.l......h.....Y....&O..d.TX....aS....b..S..h....R........xQ.....\..../n..-N...\..LN.b.\..TN.]q\...N~g.h../O)RyQ..[O._...pQ.N~n...QW..k...Q.Q.W..)R.._..QReh~n...R..)R...R..?...ZS.O....aSTX.\..aS.bGY..bS.h!X..bS(.aS...S.e~n...S.S.e...T.^.c...U.^.\...V.^.f..#W.OW...#W.W(...#WTX&O..#W.Y....#W.[..#W..\..-W.N.....W..KQ...W.)n..TX.^.c...X.\,g...Y&O.Y..'YNWnf..'YyrKQ..8Y>..g..GY.t.t..eYKQpQ..eY.eF....[-W.b...[.c.t...[S..\...[KQ....<\.N....<\.v!....].O.N...].bl....]<h.....]l..y...^/O&O...^..\...^.N.]...^.b"}...^[..W..._.fe..._.pQ..4b.~.e...b.T.e..id.~.T...efW)R...e.m.U...g.R!...\g.\+R...gTX.Y..9h...\..Qh._.....h

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\zh_Hans.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):76
                                                                                                                            Entropy (8bit):2.777864799965059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlMn6E7l2RJcls/LEn:Svm6g2ROa/w
                                                                                                                            MD5:CBF1E43602D294E22F60CDEFFFBE1133
                                                                                                                            SHA1:E9B337C3EE0C3FE63B741FAA70A51FB5A8475970
                                                                                                                            SHA-256:968F1197DF1B8B6F2FF8113B28253086818EA2C8E21C049509DC10D50ADEB7F8
                                                                                                                            SHA-512:66979D342BEBA1C32521F3797499C19FA3895E8EFE74AE6E50CAAC65AA72B282180BB3BE55AD6B4A479C393E992F88F0F12B4D2B5429FEFD5681076D519041EB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P.o!...................o!....n.pQ......n!

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\zh_Hans_SG.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):140
                                                                                                                            Entropy (8bit):3.846510265593906
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlyFzqlbVqg+UrlasJGtsh/tflPPQ3N:Svmzq7L+ptHN
                                                                                                                            MD5:222797C3BC9CF426918973066ED97CF1
                                                                                                                            SHA1:10E18BD3F6029EAC17B0DD5B464F4646034C6570
                                                                                                                            SHA-256:D14FBFD89AF2619B58720CED7B01BDE205CD5B1C04495A95A96FD03C97CCC448
                                                                                                                            SHA-512:10050C82FE674441513BF118927D0AB733AAEF7E4048696294221453F3286E450F10FE188D0CD99F16F62A008D364A0E396B68C03EF47DF8CA7FE06C6B1AE654
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... .o!...................o!....n.pQ...e...e/O~g._....#.p!....;.....K........ .#...P...P...P........n!.`...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\zh_Hant_MO.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80
                                                                                                                            Entropy (8bit):3.065932423305717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:XCbVSm/tlM4lRd6llMKH:SvTssc
                                                                                                                            MD5:0675F9EF282F3CDA710A1C06B1959D24
                                                                                                                            SHA1:F2DE1CCCB927527A4CADFC1057AC9D021967F8AD
                                                                                                                            SHA-256:001397A5D0FF3FBBDCABE1B278FD3EB55FA7917791730164515589F0409D7758
                                                                                                                            SHA-512:CFFA1AA55ED0A9ED3AAF597B3ECA4A6F4AF6B9D0A6ADA8D1CAB2227D4112B92BF2DBA0305FEE835AABEA897A21E61770F27CAADD8A38A711ADC8D34BE041501E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB...................P..3....................3....n.pQ....^%...3T"

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zoneinfo64.res

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):154192
                                                                                                                            Entropy (8bit):6.466773952608882
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:Dblc9Zh0cUdDFuMkqIlipBpcfNPSHjgdWhUSfyczLKuHsGUZvj1qheERDWF3JXDN:Dhc9Zh0cUdZqvEB8PbdWJFzeNzA2Ya
                                                                                                                            MD5:0D76CB4C8F700A77AC63BD55D73C9456
                                                                                                                            SHA1:6F9AB1F986329C147AD64B5CF6174F794F9D9358
                                                                                                                            SHA-256:A25FE98CAB0C7F01D79E008C5DEF18B330A1B7ECC4D72B067EFD37D4C1EF3320
                                                                                                                            SHA-512:FDA7B80D502AEC658524AFCBB01E80985ACA0185C4DB47FDA87FFC393C409A654B6F8B9737834BB9C44733E73E0C9C21C71E67A616D2568CC3ACBF1895A9C824
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview: ..'........ResB................... ....P...................v...TZVersion.Zones.trans.typeOffsets.typeMap.links.transPre32.finalRule.finalRaw.finalYear.transPost32.Names.Rules.AN.AS.AT.AV.Brazil.C-Eur.Canada.Chatham.Chile.Cuba.EU.EUAsia.Fiji.Haiti.Iran.Jordan.LH.Lebanon.Mexico.Moldova.NZ.Palestine.Para.Syria.SystemV.Thule.Troll.US.WS.Zion.Regions......U.S...E.U...C.A...R.U...A.U...B.R...A.R...M.X...A.Q...C.N...N.Z...K.Z...F.M...A.S...C.L...G.B...I.D...G.L...M.N...P.T...U.A...B.D...C.Y...E.G...E.S...I.L...J.P...K.I...M.H...P.F...T.R...U.M...V.N...W.S...A.M...B.T...C.D...C.I...C.U...D.E...E.C...E.R...F.O...F.R...H.K...I.E...I.R...I.S...J.M...K.E...K.R...L.Y...M.D...M.M...M.O...M.Y...M.Z...N.O...N.P...P.G...P.K...P.L...P.R...P.S...S.B...S.G...T.M...T.W...U.Z...A.D...A.E...A.F...A.G...A.I...A.L...A.N...A.O...A.V...A.W...A.X...A.Z...B.A...B.B...B.E...B.F...B.G...B.H...B.I...B.J...B.L...B.M...B.N...B.O...B.Q...B.S...B.W...B.Y...B.Z...C.C...C.F...C.G...C.H...C.K...C.M...C.O...C.R...C.V...C.W.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Button.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2999
                                                                                                                            Entropy (8bit):7.872676574137398
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:27/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODaH1Ri:27SDZ/I09Da01l+gmkyTt6Hk8nTaHS
                                                                                                                            MD5:0050F2B87610533FB835211CE7768C38
                                                                                                                            SHA1:10FF8C5A57BC95928CB4ECECB3615F3F21CE3E53
                                                                                                                            SHA-256:A266EB60C4E5D978C0B3AB1BBED3504C9F7724D9B876439F4E96790B029C1090
                                                                                                                            SHA-512:BEA5FD1E21AB2B12F0455395B151A7F9CD2D40CC352A32702D15293D5BF01F7D7910377D0D4D3EE667D2D9908D1C4AE2A8C48C380188ED2E5467816D1D2A9A6E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR... ... .....szz.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Button_Pressed.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2995
                                                                                                                            Entropy (8bit):7.87233812759291
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:27/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD4zubbRr:27SDZ/I09Da01l+gmkyTt6Hk8nT4zQN
                                                                                                                            MD5:BBB18E318B9373027B899F3BBD043F63
                                                                                                                            SHA1:38763D53BB5CDF5DD864661D1FFECC6C6985D6FC
                                                                                                                            SHA-256:C1AD63A5E2E7FF765FF5E1614C7AF90ABDB04558E13AAD1CCFAC456A701FB870
                                                                                                                            SHA-512:924463FC68F1D338FF918E8C8652535709C01D0E2FB84D5B2573A7D5B5F665B29A733C1A19F366EE6AFC1CE105D5E30B7810F61B7896C2E2C1BF5583AB497C3A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR... ... .....szz.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Check.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2930
                                                                                                                            Entropy (8bit):7.88291600595306
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:kocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD+/6LdrOp:kZ/I09Da01l+gmkyTt6Hk8nT+SLF+
                                                                                                                            MD5:D89B1D1B0B8D55FDCFA1896DBF7CBADD
                                                                                                                            SHA1:C4822D8D605AD956841C48C18A093921795D6859
                                                                                                                            SHA-256:840B1AB3934616994BF1B4B6A0BD543C4BD64C153A5FE985321231FEF037E666
                                                                                                                            SHA-512:4C1647AC06F03646D7A30EEBD3A0C035E4FCCF57803F2C84707B1630D81D6E83A3B183B37E6B4A97D65B53B761E474F2C44A667E387016FB35C28AA326646632
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a...OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., +.....3...!.[..b@q

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\CheckBox_Undetermined.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2890
                                                                                                                            Entropy (8bit):7.869946071033831
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODy:bSDZ/I09Da01l+gmkyTt6Hk8nTy
                                                                                                                            MD5:E0D6165C72DA047349DB6917F7452DDC
                                                                                                                            SHA1:0424DBC15036B5851549F0822A625AD22282FE0C
                                                                                                                            SHA-256:9AE49A3E481DD9FD20FA6E36965ED8512A80869B7ED268725A59EC89D5215A8B
                                                                                                                            SHA-512:D495133FE419E51BE39BB5F26175B4132831876C83A6B4DD458A5F3AA7772A34993E17C2DAF40EFE2BEF2D2698325BE2CE60459165B6986E107F8A5ACE5E97C7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\ColumnHeader.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2837
                                                                                                                            Entropy (8bit):7.853233109337811
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:27/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODWnB:27SDZ/I09Da01l+gmkyTt6Hk8nTs
                                                                                                                            MD5:EA84112CCCC50942A97F8803EDDCAEA5
                                                                                                                            SHA1:3032DD08E256410ED5C3A1A4A570EC947907102B
                                                                                                                            SHA-256:2F4E4424324F44CB153161DE9BCCEF6A0891780C08EC5582D5A1CF5D15FB15B6
                                                                                                                            SHA-512:F05F9A83E64C619452644D1892B644B4308F480B0B2A06203916D2094781E495E3311000E03BD0155445B5FFE199A866430AE55C39884A70C67A9F3A274585EA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR... ... .....szz.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Delimiter.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2871
                                                                                                                            Entropy (8bit):7.872173774229736
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODVJ:bSDZ/I09Da01l+gmkyTt6Hk8nTn
                                                                                                                            MD5:57E0C33C9E7086EACDFCA4AA38C1E24C
                                                                                                                            SHA1:7A2F33E9F42B171B25AE84103355967C26C1D5F0
                                                                                                                            SHA-256:F513B7CC9F56687187CC5E83B0CF5B4008C74A2E1A1DD0205ECE251E77C4F7E0
                                                                                                                            SHA-512:EA7D719D655158C5EC3FA8EE40B304ABB7941CCD1FFBF16297FD95EBED9CD364BC01CD5420847EA68B7C18B6B53216301B9844B307CF1C9ABBBC5903A72885B1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\DropZoneIndicator_Onto.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15599
                                                                                                                            Entropy (8bit):1.800599730119888
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6NpKlYk29WJsEvPg5lzwuB4BLJBLSMZxN+Y9rNGw3Gvsc5IY7XW9K:bSLQYkEWmsghxCxNXrNGkGvsc5lmK
                                                                                                                            MD5:180C749967F129693CE9CE6D25825077
                                                                                                                            SHA1:F87B56EDD6A46ECA3D2B77859A073C892B074FDA
                                                                                                                            SHA-256:35708367FAF8E3BBDFC528744D57A0C3285B77E3E640035DB7F593D8EE1BB66F
                                                                                                                            SHA-512:DA13F6D970A02D4B78E412204DB62D2F21D569CB85B78EE23CDBB6B5AFFFDF0C4BC210A538ED18B1F0B292C36F5CD23EAC02A34D4A6CFECF27AFDD39F57FA069
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....pHYs...............<.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmpMM:DocumentID>xmp.did:5C2DE4146B9111E49893B4FB72F1608B</xmpMM:DocumentID>. <xmpMM:InstanceID>xmp.iid:f4150d88-d661-8e40-ae0b-446d398644

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\ExpansionButton_CloseOverlay.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):468
                                                                                                                            Entropy (8bit):7.089121604480162
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:6v/78kFmDSKN9DDDqEvwtnMkBvC4z2r/ofgR2yc:f2aJDuEvwKIvxijugAyc
                                                                                                                            MD5:0BBDC2B8F75B6BEE90997226456EF876
                                                                                                                            SHA1:0F5C013BB5F76D4EE57DF167DB8A911FB1B0FFC6
                                                                                                                            SHA-256:0FEE50B7CFB08A5B7E308935558A826AB00A685F8876C7D6CAA4585799ADA048
                                                                                                                            SHA-512:AD211658C7BF7CB75E2BC0514B2895DD52AF98866DF936A3394DD0B73A0FA8C16C59E37D02C1F67B14B69FD8A3312AECB7CE7647B33D1B6C15D94D3C88AA3900
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....gAMA......a.....pHYs..........(J.....tEXtSoftware.Paint.NET v3.5.6..Z...QIDAT8Oc`@.[.%7.)...Q.\*.`...I......1#.>.m..J..UN.QP.O.o.S.Y&"n.4.......5.#..Y~...].6u .a..(..<......../e.au.....=r..g...4@...o}.. E .n.6q.n......kd.........N..@.,.V.(.......dl.....`.....Px....3...^.(r..a...Rb...2....c..J`,.R$..&9.#...y..w.......1...4..(.......A.<.}.....V.*.>w .e.0`.bE v.......A.FB..s...eO.!.@,...@.....A. u ...C`.t.LyL....IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\GroupBorder.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2876
                                                                                                                            Entropy (8bit):7.869300876573546
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODwAiU:bSDZ/I09Da01l+gmkyTt6Hk8nTl
                                                                                                                            MD5:490AA5F7B6E477DCD469250ECF087363
                                                                                                                            SHA1:8CEE767E4E593036A33348B2766013B7CAD750C8
                                                                                                                            SHA-256:200B77FD30AEC8BD908FBF8F706480E87FA76ABDB3A9A29F34878CA8E31F9295
                                                                                                                            SHA-512:01B7A0721D3060EBDCAA17749F39BCE49FE7B39150C6AE34DDC852FB4A563B76FB3CBD9EA770CF8DD39AF79302DAE2335B417D2CA1E0F4C1D6F591DAF95D636E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Scrollbar_Background_Horizontal.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2784
                                                                                                                            Entropy (8bit):7.898125953959213
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:2ldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBf/6A:2XHt+JcNgOSiS4XsAYNpf2ESNwSA
                                                                                                                            MD5:BCEF878CE6891793C22F6CC4D421F329
                                                                                                                            SHA1:A3962106D5E5173A038999C8AA8F5CA4BF47379C
                                                                                                                            SHA-256:894CDB8AE6C3BFB799075E4810F3971ACE713BF89BC5AB083CE958080CAFED70
                                                                                                                            SHA-512:180533A000945F8392D91A3E31205E74A9B0F099C433BCD604ED0D404A789403D8DECCB9C292E02BCA1413A0083A8F744ECA6116D71C1042DF89D3C7FD1AEFAC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u*@~..(.. ...]..o..0 ~y.*..s..7.g...%...9.%(....3........H.*...@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f..*...z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f.3...b..X}..........*.Q.Y..v...G...p.(..........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Separator.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 4 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2812
                                                                                                                            Entropy (8bit):7.866619865378966
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:w2/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODJez:w2SDZ/I09Da01l+gmkyTt6Hk8nTJez
                                                                                                                            MD5:7A83B2127057B5B48E8647CD8D6A63B7
                                                                                                                            SHA1:7F5EC98E3D1C32B59D885DCA6955B6678967C0CA
                                                                                                                            SHA-256:1719E3D3661C9CFF4A23BB72E5EF9DD2E45A9D961C8C83C46707D2FB6471BF44
                                                                                                                            SHA-512:B5C61C80B0A91C6F7BCF3E8A64B86EAF3067C725D10838205C75917FDAC1C024EB2B462BFA1BF8594F5D2C95FF9B9ACE4FB83921151FA1A12D1C1017C5AAE782
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...............~....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\SmallCheckBox.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2838
                                                                                                                            Entropy (8bit):7.867554233620986
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:2/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODpFMr9:2SDZ/I09Da01l+gmkyTt6Hk8nTpKh
                                                                                                                            MD5:053C99C0861AFA9F1818B917E52DEE42
                                                                                                                            SHA1:B7495D17E30C80046E8C28A89D60E27A98DC9127
                                                                                                                            SHA-256:C4424B85591917D64739F32B2AD98CF7B517A64AC63F5A2E0CDEC82B2EC24B83
                                                                                                                            SHA-512:4F7B92675532CA18935EB5CE185AC1955F79DE5F2A052FE1DC13BFFFC005F4BA0B68A22E8573D13EDAB005270E6C19851300DE6A989BDD7806ABB2522033F17C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR..............H-.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\SmallCheckBox_Hovered.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2836
                                                                                                                            Entropy (8bit):7.865935447689982
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:2/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODDLsN:2SDZ/I09Da01l+gmkyTt6Hk8nTDLe
                                                                                                                            MD5:DB8437A8F2BC6FF9756AEDAFFE55122E
                                                                                                                            SHA1:DA7ADE552ECB7FF2D5EACC5DE4818CA62AB8946E
                                                                                                                            SHA-256:AA7D5A698596D06194515329C39767F7219162C1B2B8DB8CCD4311A16A0CA16B
                                                                                                                            SHA-512:A5BEB564397C270EDC72A72C77B0E0EC096EBF1A5CCBE074A71B83587D4D538C5D073B02FE47416FE635A30B7F83650DC827C1CFCF99B25EFA6AB4BF8320D13A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR..............H-.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\SortDownArrow.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 8 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2811
                                                                                                                            Entropy (8bit):7.874236433479311
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:0VocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD+/6u8:UZ/I09Da01l+gmkyTt6Hk8nT+SJ
                                                                                                                            MD5:FAF4ED201C26BAE9E687DD4FF5456041
                                                                                                                            SHA1:979627FEF736DE553C5AA0169720B04F85150111
                                                                                                                            SHA-256:4BF8DEBD83FC146673F09E846BF62A2D6934D43E1D231BEB16E854652E2D7A94
                                                                                                                            SHA-512:BDF7B5B41A50C378A689A0506FE91E7121738E877250CCF1F0A94E18C88E6F0FFC76D56E6FE7CAEDF13E83C75AC36BE53342E2B8922496BB878C5D616C2E655D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...............~....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., +.....3...!.[..b@q

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\SortUpArrow.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 8 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2808
                                                                                                                            Entropy (8bit):7.8765574063891295
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:0VocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD+/6TgQ:UZ/I09Da01l+gmkyTt6Hk8nT+S0Q
                                                                                                                            MD5:24C86B20F3A1850116F0C4052490DB59
                                                                                                                            SHA1:D61178F5C4875A7E4039FC3680204FBF26E1C815
                                                                                                                            SHA-256:1909A2B9421ACE6C4610C8A967F6E477529132ACBC7474CA0ADBB0F7CEF1BB74
                                                                                                                            SHA-512:69A79870610B6350A9AD5F2DB6BD073F7B0C62E790681C17F8AC6268594349698F09231D159394BEBC5C2FAC80A9F5259E4BF5D108984860A718D5D45EEFE485
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...............~....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., +.....3...!.[..b@q

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Spinbox_Fill_Hovered_Dark.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3171
                                                                                                                            Entropy (8bit):7.899498876019361
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:CldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBDVRDrLmt1UG7:CXHt+JcNgOSiS4XsAYNpf2ESNgLMUG7
                                                                                                                            MD5:32466EAF2EE705725C4372710A5A3484
                                                                                                                            SHA1:63DF604C3788457CB7DB6DDE90999F20C1B29B4C
                                                                                                                            SHA-256:5D1A57C140142E3466D97B7CD17D364F6908A22C670E9DE7FAD93BDD90B5210D
                                                                                                                            SHA-512:7B25063E9F92758A383BAF4A412AAAA5ACB9E5872A2C3B216079E22122781294256C59619463B90848C24CD4E71366C22B20094AE09B5A9C836D87E0F6FE70DC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....gAMA....|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u*@~..(.. ...]..o..0 ~y.*..s..7.g...%...9.%(....3........H.*...@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f..*...z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\SplitterHandleHighlight.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2802
                                                                                                                            Entropy (8bit):7.861531898056138
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODQ:bSDZ/I09Da01l+gmkyTt6Hk8nTQ
                                                                                                                            MD5:9DD1092BA0D5B0AA805FF78728052FD5
                                                                                                                            SHA1:799E9FE238D3D3B62D34B3F21F2C5F0F275999DA
                                                                                                                            SHA-256:910A084AC16C65AA71E79AAE4884BA010EEE5DE6E9E8ED671E080DE335400421
                                                                                                                            SHA-512:076FD1AF94F67AB359AC2FD6F8978A1B9D515F4A2791515530271141846BD84D1F8E726A972EC84962471C760143D010A5ECBD3F32E23CDAA57CD3BBF8FAAF29
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\TableViewMajorColumn.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):320
                                                                                                                            Entropy (8bit):6.988275403142871
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:6v/lhP12/6TSlQE7EelEQ1Zsr9n9xhyhY8yjhjvegmjniSVdwup:6v/792/6TeQUSr9n9Llhjtv/UiSAc
                                                                                                                            MD5:1BEB398B37A81C6F743A7BCD8076477D
                                                                                                                            SHA1:3F60B75477D49793B0B91746C519D28CBA8D9EBD
                                                                                                                            SHA-256:E2CFF5756D4C0496BF6864EB36436D9426849CF2CAB678B8B2F360607DA8110C
                                                                                                                            SHA-512:309EDD39FEB63270CBDD6FA06D0E4AEE86C580476DBAA4A58307D780CB357C151375397903091B91B3109974DA5EDAA9ABEF3C4953ACEEDD17151B5072C5DDA5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR... ... ............pHYs.................IDATx..V...0.........L+{.k...l.M6;...P@^.u.&.......Hp..f&..8.y..e1..7.......E....y.w.....E".ZD.z...w.6tPk..|....|.....tP......K.]w.R..W.n.........c,9....ZD.2P..z........u.p.%.....<...(K...F9.q]N...,.....*/.6Z;E...F....m..G7.m.1....2.o.......IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\TextBlockHighlightShape.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2827
                                                                                                                            Entropy (8bit):7.867316892820178
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODy+paUW:bSDZ/I09Da01l+gmkyTt6Hk8nTJW
                                                                                                                            MD5:5B6EC4EEBF6FDF67C3C6FBD673A46370
                                                                                                                            SHA1:53181029FBEA06AED2E663392654737696F5B4CB
                                                                                                                            SHA-256:8F6C088620C842670EC544DFC4B0313795D8E52C4203472848CF9558D06D1597
                                                                                                                            SHA-512:3A9478F764F5AA6FDD239B4217DD9A60AD600CD0F06F108AD23F9F2BFDC71387457F35DCEC3B66F497C00A838BF7940A6E3C9AF718B3FBCB73ADF0A212395A0F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\TextBlockHighlightShape_Empty.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2843
                                                                                                                            Entropy (8bit):7.868357699094754
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODOzF:bSDZ/I09Da01l+gmkyTt6Hk8nTOZ
                                                                                                                            MD5:212B43546F774BEB2ABB9D7A1B7B5076
                                                                                                                            SHA1:78AF6E84B7DD56CEED551580D6634FF40D0B9ACA
                                                                                                                            SHA-256:0E3C193F90CA6E0109584D51036DB71EFF5EE8E5A2D17994EFFC379A94893DD3
                                                                                                                            SHA-512:638E4414A7B24234C03811C0C638C62A89090E9FE8A5909D3CA82F6B3940F81C6381128664787B44CBDAFAAB44D583A0BD1572E2BBCB454CF4718CB8F769A5A6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\TextBoxLabelBorder.PNG

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2871
                                                                                                                            Entropy (8bit):7.870767548972718
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODcF:bSDZ/I09Da01l+gmkyTt6Hk8nTcF
                                                                                                                            MD5:C988D0BC16B46F5D878944FBF953132C
                                                                                                                            SHA1:C0B39AC1FE4476E016C5A450B4479905BCAC11C5
                                                                                                                            SHA-256:5E9D32D1168A13BF9C112D3696968F2A6B4ADC3FCCA0C4970AFF07B3F105DF1B
                                                                                                                            SHA-512:FDE833EDE566D846E1C9898E0B5EAF01A52E03AA71C91790547CF41CC2EAA72F07DA2EEBEF5301FE346DB08943F80B7A36D5CF304C7CAAEC0E07162E2D8CB0CF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\TextBox_Special_Hovered.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2975
                                                                                                                            Entropy (8bit):7.8649855935944375
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:27/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD/AV:27SDZ/I09Da01l+gmkyTt6Hk8nT/AV
                                                                                                                            MD5:C0AD6235DA2F86747861A36538AC70F9
                                                                                                                            SHA1:7A171C42FA927323189647D7BEECA7349623C615
                                                                                                                            SHA-256:F93F51EA88F7636BF442F963A944105C984D89266AB4FC7258389578348F9692
                                                                                                                            SHA-512:752E24A4A24289440D5682D850B450E277AB3CC8A914FA6BD851EE71B85D71D70E03BC6F257728A61EA87FC65EA2F330E821F8871395CACF1050AA55794ECE22
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR... ... .....szz.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\TreeArrow_Expanded.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2830
                                                                                                                            Entropy (8bit):7.862535708330178
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:8/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODc:8SDZ/I09Da01l+gmkyTt6Hk8nTc
                                                                                                                            MD5:21064FD5CAC8F583FBA95AA6953111F3
                                                                                                                            SHA1:158A51FC11058CFB003E8CB45545E66D2E7FD81F
                                                                                                                            SHA-256:DE9246A393815B14492002F3CC4D859F56FBC1CF9C49E06E075F4691D7CA021C
                                                                                                                            SHA-512:10A3196D8BFA2F343740C2DD8B3CE8F326CE275DEF5B361E79AC838C2F6CC2836C90184BBE5E17F10AF1161BBD8AA5FA6789F057CF378E3906ECDE494B2CDF6F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR..............2.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\TreeArrow_Expanded_Hovered.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2837
                                                                                                                            Entropy (8bit):7.8661845192086775
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:8/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODWiYh:8SDZ/I09Da01l+gmkyTt6Hk8nTvYh
                                                                                                                            MD5:74EA6C1EC3302A30AC47AAEA7BA3AFD5
                                                                                                                            SHA1:7E3DE37638F605228D702FBF9AE275B2FFA2467D
                                                                                                                            SHA-256:26BAC352EEACB2139C645948DAF380FD54154B6E3473BAD6517412C736E47220
                                                                                                                            SHA-512:84C5C545CE6A8DF0FE228ECD4262AD3FCFDBD0CCF10327982E785C7A30B9A6274367B1078046890BF5470BBA531641F14B4E46E44F7A08BF281AD83AE89CCE0F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR..............2.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\VolumeControl_Muted.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3098
                                                                                                                            Entropy (8bit):7.882667962977238
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTAC5Beq2K:bSDS0tKg9E05Tb5wqR
                                                                                                                            MD5:C0F38553BDFD691A26D624AC3FEC0D1C
                                                                                                                            SHA1:50CFA6315550065669BD48912EC5CA34E837EFD8
                                                                                                                            SHA-256:2A18CABADF86772481B7A59F157255DF469494A50DDBEC37AE69F73A3B54C132
                                                                                                                            SHA-512:F8A78AE47FEF7C762E061E9B5D450AA201A85B0F50375F844A5174CE9BF1793E70AA27C3FD948BC1F564E272ED59FF31074055388A6C33BE13F97D383BFA93DB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Window\WindowButton_Maximize_Normal.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 23 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):394
                                                                                                                            Entropy (8bit):7.193650253140461
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:6v/lhP4InDs1iXVul/QOLh+0LrKVISIs2fsenV5P8jImCWRagC2J0xOJngZbzxGm:6v/7QHEXM1QWjDVVZ7WJ0cJObAE9
                                                                                                                            MD5:EA3D34758ABB1A8D437DF38A005A371B
                                                                                                                            SHA1:67F6881C0542FA2BF316396984045F670CB36350
                                                                                                                            SHA-256:A9FA831F1A4BA646AE08DC38FC3F8E0C87AD5B5D2F60E83795FE4A3D33DD7B3F
                                                                                                                            SHA-512:2A97913834864DCE58C78CD84D9A82454CDFE1F329976FE8583EEF2B01423F04F462BBA2B737FFC516FB3F8C4927EBDE693F7AA98296802EC649708BD4C76875
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...............E.....tEXtSoftware.Adobe ImageReadyq.e<...,IDATx..=..0....b.....3.7.[X...{.K.. ......6....h#.n.....N...D..%....B_.4.I{E.....q..M...UUE?x.....].-I../..8..$...,+r].r{.u...EA..8>..s..1(n../.u.....b.......0..8.Y.,[.....B.4.9.A.m...c..m......8.....w4?.......a..Mg..-UU.M.2.sQ.#EQ<.l.e9b.0.o..i.......'........0..~...^P...........o...o.....$1....IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Window\WindowButton_Minimize_Disabled.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 27 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3076
                                                                                                                            Entropy (8bit):7.877665076819138
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:x/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD6CpzYGCZN:xSDZ/I09Da01l+gmkyTt6Hk8nTBpzC
                                                                                                                            MD5:63EC748BA3EE9D5878A13517FC057B8E
                                                                                                                            SHA1:34433D0E95BF119F57AB9A4D655733F8B9979764
                                                                                                                            SHA-256:74C028A7D741885103571D493D69B1362083AD225957607EC8FE3473C9D9C6A3
                                                                                                                            SHA-512:5B86C7EA5BB33121433C41F72625D30E5FAC4E66858C49C59618B07BDFFF8DC37EE71AB80B260740317340F23B5AFDE63800FF0B7C57206F8AFE8F241EBE481C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Window\WindowButton_Restore_Normal.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 23 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):480
                                                                                                                            Entropy (8bit):7.3467258325775875
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:6v/7QHHwMobOEQkkcoJHw55TQaTsybKLU0MlgFLciT:6BuDHwLdbKtMiHT
                                                                                                                            MD5:350CFCEC86B83D85A4A60C62D0B97F0D
                                                                                                                            SHA1:CDB19CE66B2C09BF3704DEE19B76090F251578B4
                                                                                                                            SHA-256:054A094D3D73DDDAAA46F2194000D5EE514D1F824EC554214BBBC4643E126718
                                                                                                                            SHA-512:8679F9EBEDBC995AEEB3F9C25A5F0399120C7B471C79CDF81B07F881DFDDD99873BDD601EB7AE040791E1A340D1955A5B3391D94240A8CC04952281D0314F401
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...............E.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.....@......,...1..br&..o..X.....K.@z..{..+Z.!....@...."...eA..$..v...fg...R.4....=.F..O..&..oZ.d2.[.%.Q....\...o.v.e......Uh.............\.... .ey.8....>.E.B..!.$.....t:W....I.E......x.$%}..=..8F...&a.{.bI=0+...x..adY....v.....p.u+.~.l6[......bI..<...d.,._..0|.........4-+.>p..o..w..k...........-.... .J8....q...j..R.O...[.s+{RW..z..j.z.....%.&...._..5/..^h..........a.....IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Fonts\DroidSansFallback.ttf

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:TrueType Font data, 20 tables, 1st "GDEF", name offset 0x38ef38
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3939852
                                                                                                                            Entropy (8bit):5.92234653192698
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:49152:+iLWe66X3OGV/TCEJBiaqpW0c4MDSc/F6b2QU6xyc:+dY5LbSc/Vc
                                                                                                                            MD5:8E6CFE94172AC67B8F216BAA023BD7A5
                                                                                                                            SHA1:C5E4F11E2F1D0B84E5F268A7EBFD28B54DC6BCDC
                                                                                                                            SHA-256:05D71B179EF97B82CF1BB91CEF290C600A510F77F39B4964359E3EF88378C79D
                                                                                                                            SHA-512:339E0ECB4B05D41FF9785F810F060993D36650F1E942F1A9077DD56889FF7702469F831543BE3DAEB72C1362D1F554DEEF9D67A9E3AC3EAE62557AA1C069E3F0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:...........@GDEF...x.8.$....GPOS.1S..8.<....GSUB...c.8.H....OS/2]3.q.......`cmap~Db....h...Pcvt ......:.....fpgm.!Y...:.....gasp.....8......glyfk.....X..2..head......L...6hhea..........$hmtx.......(...@kern...6.8.H....loca..x...:.....maxp.../....... namev/. .8.8....post.....8..... prep...)..:.....vhea...e.9.....$vmtxxw8..9.,...............q_.<..........Gxg.....F.......8.........................M...O.8.................(.....x.T.'.......................................$.......z...>................+......6....1ASC.@.............D ?............. .....K.........C...E...g...................:...M...M...........@...R...E...`...........................................E...E...............m...........................~...........W...E.......~...........................................................N...`...N.......i.....1.........w...........T...........B...B.......B.......................f...t...W.......{...........}...q...[.....=.[.......C...E.......|.....&.U...}...R.......i...n.......U...U..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Fonts\Roboto-Italic.ttf

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 23 names, Macintosh, Font data copyright Google 2011RobotoItalicGoogle:Roboto:2011Roboto ItalicVersion 1.00000; 2011R
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):160736
                                                                                                                            Entropy (8bit):6.406235756728495
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:rPfJaXF3u4IV+ejFFT5Y+E75LOiH6LuVZmxAHoShcZX/oV/B:rPBaXFhdx6LuHNIqcw5
                                                                                                                            MD5:93B13A58DEDEEBE519846555A543523B
                                                                                                                            SHA1:2A5AD885C7E58322832E6E651156FFC131E27F2E
                                                                                                                            SHA-256:470123C6FB5D6C0005431C0F5390742497C55087361A7636B7E82EB35635DED7
                                                                                                                            SHA-512:A0552548C6C0986EBB7B245AD0D4C147A6BD73FEFDCCB095DEA59423D203CF57556F33175984BD30E3F815504F2D581B31955D98B3D70773F88543B592A43C98
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:...........0DSIG......s.....GDEF.`.a...<...HGPOS.*`.........GSUB.&.....$....OS/2..)........`cmap..N4........cvt .T.q..j<..."fpgm...R..j`...%gasp......j4....glyf.e........cXhead......L...6hhea...4.......$hmtxn..........4kernwal}......0.loca.Mm...:.....maxp.4.~..C.... name7.&&..C,...4post..b...F`..#.prep.....s....M.........................4...$./...H.H...O.P...R.R...h.j.........................,..DFLT................kern....................K.T.p...w........<.B.H.............>.`.f.......&.L.r.x.b.h...................8.R.`.~...........j...N.`.v.............@.f......... .F.L.R.X.^.....,.J.h.................".D.f.........L.....N.l.~...............2.8.N.T.j.p.............6.X.^.......6.d...........8.Z...............................f.....8.Z.|.........................J.`.........:........ . B L!6!.!."0"6"X".".#.#.#B#X#r#.#.#.#.#.$.$.$.$P$f$|$.%p%.%.%.%.&.&(&v&.&.'X'z'.(J(x(.(.).)()v).).).*.*(*:+$+r+.+.,.,J,p,.,.,.,.,.,.,.-.-.- -6-X-r-.-.-.-......@.b.|............../ /B/././.0.0@0^0x1>1H2.2p2v

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Icons\DefaultAppIcon.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1489
                                                                                                                            Entropy (8bit):6.937783205392521
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:k1hpunQWwh82lYSKwg5F6KrVnT3ZyJ3VV5FPg5/G1DJkzRimgVO4nz7tpZugNG2Z:qitvnLJb/t0J37bIhQg4/VOgpbx
                                                                                                                            MD5:9B48C0BFDD449F486856313661EA6B65
                                                                                                                            SHA1:441EFA7E9CA9C297244C2755039A89ABC1461786
                                                                                                                            SHA-256:4D225F27C9976D1D83B81F6CE3A0BF5636715F7A48539E4CE730EF1AF7AD4D41
                                                                                                                            SHA-512:F2CA6CF4BA86A28AEAE3F5874D46AEBB1DF698F52B4E3516C0282E7B8EDCC5CFD7B54C94A1710876FCBAFF648C6E8E954B6B2157B265902CDADE82BF19B4C42E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR..............w=.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:751DC2B63460E211AC65BF1B98CD7C88" xmpMM:DocumentID="xmp.did:B31057CD603711E2AE60E3892217AA0B" xmpMM:InstanceID="xmp.iid:B31057CC603711E2AE60E3892217AA0B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:771DC2B63460E211AC65BF1B98CD7C88" stRef:documentID="xmp.did:751DC2B63460E211AC65BF1B98CD7C88"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..+.....IDATx..=,CQ...kK.T........X$.:X.b0...*F....I.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Old\HyperlinkDotted.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2812
                                                                                                                            Entropy (8bit):7.86184881742406
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODna:bSDZ/I09Da01l+gmkyTt6Hk8nTa
                                                                                                                            MD5:92BED1361E9D9153A03FC511E53200F5
                                                                                                                            SHA1:68A026D12742851DDBCC7857A299F9EAA311326E
                                                                                                                            SHA-256:66078DD3E9027C1C1B2806B5E61ECEA4C94FFA2443319FD57C946BAD6E100BD8
                                                                                                                            SHA-512:4934258571A8729AC839F792D1E83448DE876D71852883A92453A88EA49DDAE55890E3F1E17087632F23A4D9B1124C5A977D60E96806FE4348DC191F6A9BA802
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Old\White.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 1 x 1, 8-bit/color RGB, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2791
                                                                                                                            Entropy (8bit):7.8621000348376775
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:+s/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODM:+sSDZ/I09Da01l+gmkyTt6Hk8nTM
                                                                                                                            MD5:0EF0B9F99CF01B5651916855B573CA40
                                                                                                                            SHA1:836D500234DC72C3E1597C9FCC20FFA6874E4A38
                                                                                                                            SHA-256:C92F44352266051BC2F319BC3D1211646E71E88D00212C91933D6D441B00BE7F
                                                                                                                            SHA-512:097006D890983016B58D1E6F0BD0A899DA2E41BC73960D6B4A63F9938B9D2153DC72AD6CDADC3297FCA5BA30DD8CA546BCBE13A6C0416C1658209220922EFFFD
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR..............wS.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Plugins\Messaging\MessagingDebugger\MessagingDebugger.uplugin

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:JSON data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):480
                                                                                                                            Entropy (8bit):4.946526263578106
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:CxK3ESXLSYoBXLMaHCfOOCkx4nOCr7fLrzZl/E9TsYyHQR:CkPX+Y0XfVOzxyTJl8aYr
                                                                                                                            MD5:089B05C0EB3300BCF271E2B54E3E2B5A
                                                                                                                            SHA1:FFA3FD953F7E0024DDAFDB0D58D9F354AC31E923
                                                                                                                            SHA-256:BC762E1495DB943541AB7A48B138BEB28ABBEDA67545AA46CD54ECB673748D9A
                                                                                                                            SHA-512:C2DDE046AA1CFD8F0B61F5BBC2F8662272F59DD0D4A7748249B01B21A583B172737C093E80ABE0A2F27CDA54CAF9E7A19618A3DF4154AE06064BF1E94B5F0642
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:{..."FileVersion" : 3,......"FriendlyName" : "Messaging Debugger",..."Version" : 1,..."VersionName" : "1.1",..."CreatedBy" : "Epic Games, Inc.",..."CreatedByURL" : "http://epicgames.com",..."Description" : "Provides a visual debugger for the messaging sub-system.",..."Category" : "Messaging",..."EnabledByDefault" : false,..."IsBetaVersion": true,....."Modules" :...[....{....."Name" : "MessagingDebugger",....."Type" : "UncookedOnly"....}...],....."CanContainContent" : false..}

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Plugins\Messaging\UdpMessaging\UdpMessaging.uplugin

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1053
                                                                                                                            Entropy (8bit):4.955264747326076
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:CWsX+Y0Xe9EAcXBUVV/A4NVnY9ybrxIl8H9fD8Gv6vq0t:A66EAcXBUVV/A4NVKGH9fppo
                                                                                                                            MD5:2A3C034D75002CA9AD566D6BDE453A09
                                                                                                                            SHA1:CCAA60817A2C30C93A6EA94666AB69F2E6F0FD3A
                                                                                                                            SHA-256:0FCDBDAE1432456BF0B00B008BC716A5275E4A3006E9B50A3DF291463FA8B3A2
                                                                                                                            SHA-512:EA9A4640144CD76F3DF66B0EC042CFB93DCF6E7D82FC18D9B9B69E9F9C1373B09E369154C446B79F713B6B7C2D3F6C663D43A9944666420A6C57C5195F7081EA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:{..."FileVersion" : 3,..."Version" : 1,..."VersionName" : "1.0",..."FriendlyName" : "UDP Messaging",..."Description" : "Adds a UDP based transport and tunneling layer to the messaging sub-system for sending and receiving messages between networked computers and devices.",..."Category" : "Messaging",..."CreatedBy" : "Epic Games, Inc.",..."CreatedByURL" : "http://epicgames.com",..."DocsURL" : "",..."MarketplaceURL" : "",..."SupportURL" : "",..."EnabledByDefault" : true,..."CanContainContent" : false,..."IsBetaVersion" : false,..."Installed" : false,..."SupportedPrograms" : ...[...."UnrealFrontend",...."UnrealMultiUserServer",...."UnrealRecoverySvc",...."UnrealLightmass",...."CrashReportClientEditor"...],..."Modules" :...[....{....."Name" : "UdpMessaging",....."Type" : "RuntimeAndProgram",....."LoadingPhase" : "PreDefault",....."BlacklistPlatforms" :.....[.....],....."WhitelistPrograms": [......"UnrealFrontend",......"UnrealMultiUserServer",......"UnrealRecoverySvc",......"UnrealLightmass

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Engine\Shaders\StandaloneRenderer\OpenGL\SplashVertexShader.glsl

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):247
                                                                                                                            Entropy (8bit):4.772084734516376
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:4xMgm9LCpxDZhysjf0A/FBFTAVI2z6x4MjpOe6LS:4xMgmpCrys/TAKhmZegS
                                                                                                                            MD5:57CDB5700C86980027AEECBB438CF921
                                                                                                                            SHA1:68F34555F22616D10AA8D1444B363E6959D7D96D
                                                                                                                            SHA-256:56420086CE3D8A813F1F01C9A026AAFB46FB461B5BE0CBE2A826BB905A05B18D
                                                                                                                            SHA-512:494317BB8D2002387E67BEB77E269DD9BA441C8EAFE1314CA1312C4B14806858E50219A25B207686FCEEDFBDC58EB08B4C004ACC62A253502F48CCEA356F9733
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:attribute vec2 InPosition;....varying vec2 textureCoordinate;....void main() ..{...// We do not need texture coordinates. We calculate using position....textureCoordinate = InPosition * 0.5 + 0.5;.....gl_Position = vec4(InPosition, 0.0, 1.0);....}

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24814032
                                                                                                                            Entropy (8bit):6.61377507951845
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:393216:zOXVPufF3cxFp83+M4LAYaPEfCnxUQvXX//fHYU7vIFGvAtTMJL7zX3ZU7d:aJuWxFi+M4pWnxnn/3l71gT4Xod
                                                                                                                            MD5:52D1E3FA3C64EB023B5E2D0A14C582AC
                                                                                                                            SHA1:57B21E64028A7ABC9EC0939E0BE4A483B95C865F
                                                                                                                            SHA-256:FB5935F713A90F44E36268E7845233EEE431BF9D993B71369CAD0FF7B0118C30
                                                                                                                            SHA-512:CB100EEA7A4FDCD73D2B0CC02AEBDB228EA506637F6C6E9F164B76FF90A272F4E18D8F1C48F0F67B0D67E749DCFF29FB72532052F35B0C45071388168CCC8005
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$.......R.4...ZP..ZP..ZP...P..ZPM._Q..ZP.Z.P..ZP.^Q..ZP.YQ..ZP.[Q..ZPM.^Q..ZPM.\Q..ZP._Q..ZPy..P..ZP..P..ZPM.[Q:.ZP.._Q_.ZPG.^Q..ZPy..P..ZPy.\Q..ZPz.^Q..ZP..[P..ZPy.[Q..ZP..^Q".ZP.._QN.ZP..^Q..ZP.._Q..ZP..ZQ..ZP...P..ZP..XQ..ZPRich..ZP........PE..L...z38e.........."......v....m...................@.................................m.{...@...........................W.......W.p.....|..............hz..9....}.0....]U.T....................]U.....8UQ.@...............,.....W.@....................text...J........................... ..`.uedbg..=n... ...p.................. ..`.rdata....;.......;..z..............@..@.data...`$%..`W......FW.............@..._RDATA...'....|..(...Dn.............@..@.rsrc.........|......ln.............@..@.reloc..0.....}......xo.............@..B........................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-console-l1-2-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17872
                                                                                                                            Entropy (8bit):7.153735246661642
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mbWfhW7+Y3DGk8ZpH3GCJErK9LsS+Y3DGUGq8JN77hhcy:/+DGkiRBEYLsmDGt3hey
                                                                                                                            MD5:4B91D0429B73A1264196D33E68E34590
                                                                                                                            SHA1:3797ADBC0A7FA69C93E92F365A6C2752EB3159DA
                                                                                                                            SHA-256:8741EF421E17186E20EED219AE1C38999BD57BF655C69828C751ECC866F3C366
                                                                                                                            SHA-512:3EB4E8327587A3B9897B245C57EADEC72DF0A06564ECA6F3DD032289081B12E55EA3C8F29A1284FCD03A870F60BB9EAA55DDBB8EE41DD2F306B48A29C3EBD095
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L...g..............!......................... ...............................0......e.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@....g...........;...T...T.......g...........d...............g.......................RSDSi?...e.t[l.W.Y.....api-ms-win-core-console-l1-2-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02....................g.......................(...l...........&...I...k...................[...................,...Z...................=...^...................I...v...................K...r.........................................api-ms-win-core-consol

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-datetime-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17360
                                                                                                                            Entropy (8bit):7.148717476886636
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mXQWfhWPe+Y3DGk8ZpH3GCJEFxJo7+Y3DGEM98JN77hhuV:eBIaDGkiRBEaDG83hwV
                                                                                                                            MD5:8153A83C61B397EC05126E100C1EBC43
                                                                                                                            SHA1:44FDAD765281C9EFF2956A77AAE2F4918EC6D365
                                                                                                                            SHA-256:076B0C0FC207608E2866383A2E37EE8E876AFDD067B4CD2BDB32250764218835
                                                                                                                            SHA-512:920945108097B4B758AFD7A21BDEF58B6075B19F192C387C1885484F3FFCBA8F2F799395952AA6555574DE8E520E0C53135F2125C6EE8A8C5255080F24EB84A1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L.....1............!......................... ...............................0............@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@......1.........<...T...T.........1.........d.................1.....................RSDS..gi...R....7.....api-ms-win-core-datetime-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................1.....P...............(...8...H...................t.......................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-file-l2-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17360
                                                                                                                            Entropy (8bit):7.224137599556334
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mPWfhWG+Y3DGk8ZpH3GCJEFxaD+Y3DGELOFG8JN77hh22:PtDGkiRBEyDGbFh3hA2
                                                                                                                            MD5:7C4F941EABFA3285C56B812C190D5A48
                                                                                                                            SHA1:1E316D51EEEF1467FD7DDF4BE55504A78239A148
                                                                                                                            SHA-256:78347E7862ADC452CDF178B06D1CCF7401162838D320BD74C6CE34FF1804EB95
                                                                                                                            SHA-512:DF3C343A252C44492DFD1F1DC9D048140788B4BE912A0792354EB37F5CE0188E5B5DDE63C4658B358F98005D98F93F6A8D6698FB7C8997F8D20B3BACCD4D2711
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L.................!......................... ...............................0............@.......................................... ...................9..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@...............8...T...T..................d......................................RSDSD..H]F..$.JN..=....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):16848
                                                                                                                            Entropy (8bit):7.247430853810146
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:m4rGpWfhW8+Y3DGk8ZpH3GCJEFx5v394qxq+Y3DGEY8JN77hhelG:xGeXDGkiRBE9vN4q4DGu3hQlG
                                                                                                                            MD5:4AB8150E796F0CA19F4AD2FB64150646
                                                                                                                            SHA1:FF15AAEFF3DBC40129C467A135DDA60BF3117735
                                                                                                                            SHA-256:BB37792496D6BA917BEB211D3976A82D4F9DCCB6F6B9FB87F9491E0CA82BF947
                                                                                                                            SHA-512:5EF0EED7E6FEA932336C953D3A571091E73DA4D61C73B05380B2180C70E16D8DD34AF8E5D289B89CED43389E547C6CDB5693DB40CF76FCA22A094E15FE0EB381
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L....6.............!......................... ...............................0.......v....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....6..........>...T...T........6..........d................6......................RSDS.E._).(.*R..&.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................6......F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-synch-l1-2-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):17872
                                                                                                                            Entropy (8bit):7.193538916326205
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:m7tZ3cWfhWp+Y3DGk8ZpH3GCJEr9sZv+Y3DGU28JN77hhEPj:moDGkiRBEQDGO3hyPj
                                                                                                                            MD5:E455E34100BAECF26ED8FDB1406242EA
                                                                                                                            SHA1:C787D74505DBF3B86389B115B69F18DD61CF0528
                                                                                                                            SHA-256:D3852236D0915D4E5DAFC3067442B42DB52B914E47EC01BB7DE4D7452732E1DE
                                                                                                                            SHA-512:C1615354CE6AAEE0100D2E6F3975CB2316E860B06319527A02CB49716179B94C92D2BA2DBC1F3A6F71D008F19CE068AF7BB3282D59D55D4F1E0CCCE587CAF749
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L..."Vnl...........!......................... ...............................0......0.....@.............................v............ ...................9..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@...."Vnl........9...T...T......."Vnl........d..............."Vnl....................RSDS..X......_...]....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02...................."Vnl....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...|...............H...................A.....................................api-ms-win-core-synch-

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-crt-heap-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18384
                                                                                                                            Entropy (8bit):7.103823239247684
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:m6Y3eRWfhWFI+Y3DGk8ZpH3GCJErS2B+Y3DGU8J8JN77hhAAB:pGCcDGkiRBExDGQ3hK6
                                                                                                                            MD5:4A643A9B6C4A6DC39C9BE0FED6792FAC
                                                                                                                            SHA1:00B071365192D22067C9A31E41F69B15B0DC1E64
                                                                                                                            SHA-256:C737F548852321F30520ABC558546CD62AB35AB101903D109CD369C49682ABDD
                                                                                                                            SHA-512:D9556388B146371F2E576205214AB640E81A5E98B6701C24A8A29C45B06A98DB4EB3613AE28826A1B022B2ECB4C2F7D7E87C1C6B6818C3D9E07B71B8CEBA50DC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L....-.............!......................... ...............................0.......x....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................-..........7...d...d........-..........d................-......................RSDS..y....o.e(.........api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........-......6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-crt-string-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):23504
                                                                                                                            Entropy (8bit):6.886972961049936
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:mEiFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWfhWK+Y3DGk8ZpH3GCJEr96/reYrW:z6S5yguNvZ5VQgx3SbwA71IkFD1DGkiw
                                                                                                                            MD5:18422C38DEF645AD0486C1314BC0D5AA
                                                                                                                            SHA1:36CC7176357C418F01CC3AA9829E0C61AC4ECA7F
                                                                                                                            SHA-256:A5ED1A22EB5E3AC01780A50ABE4C6EAC33A13D07D9863CBDFB549EBD55CB18F1
                                                                                                                            SHA-512:52CF57B22ADAA77DBFF77ABB9C56C76346F429D1A268E286E149B3FE64236901B0DDCF9003AC3D41BDC7C5D7C991216D2F6F659FBB25DAC6FF2DCB6F4D9FDF5D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.PE..L...#............!.........................0...............................@.......6....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v...................#.........9...d...d.......#.........d...............#.....................RSDS.Hx..iz.u..X..+)....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02....................#.....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\concrt140.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):248272
                                                                                                                            Entropy (8bit):6.687157681428619
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6144:Y2y3hhQZpA2C/VFuGEcL6hmDCYfM1+/e7VR8AocazlBQdSkIuVxRYy12z/VszBRA:At+zsM1+WkzRuVxRYPzS/o
                                                                                                                            MD5:8C5B8534B0C109DB8A5A5AB87D12694D
                                                                                                                            SHA1:EA90974A783DBED4A75C21B99B41D5CBB654F76F
                                                                                                                            SHA-256:CEA5D28EF647C7E92B7A2D4079467E7B398DD2657D661CCFFBA22E1E644FE7D1
                                                                                                                            SHA-512:85933C706FA19ABF1B5A8E373F8D9D41DD7281791A2C62EEFF56D46FD8C1DD9D00824EA762D3A3455F9024065AB6E8AF4DAE0AC56329FE3A3F51D9215D4DC588
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........HD...D...D..../..F...M.~.N.......A...D..........O.......C...............E.......E.......E...RichD...........PE..L....h.].........."!.........x...............0......................................p.....@A.............................K..<r...........................9.......+...;..8............................<..@............p..8............................text............................... ..`.data....4...0...2..................@....idata.......p.......N..............@..@.rsrc................`..............@..@.reloc...+.......,...d..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\msvcp140_2.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):171472
                                                                                                                            Entropy (8bit):6.8632776689309605
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:CZBtkzIR4IBNvjmKJ7VDoeRLaauW4OIU7bhI/D:CZjNvjmKAeRuauW4OIk+D
                                                                                                                            MD5:05963BB57765610B241F909C61222B54
                                                                                                                            SHA1:C8BE433CAEB7B40F43A293F0080ADAF361EC9CDA
                                                                                                                            SHA-256:3B8D61A4A9B13C073623D17E423763C89F76B76623818F22BD5CFC678717DEB2
                                                                                                                            SHA-512:E8B59F0672CF1E7D0E4ECFA109114672202DCC94D31CDA6D2E9A308E2E50B833AB827D80DB043889599E77F74DED66E7D54700BC96A6D1FC147A062C33E195A2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..,.............p........g.......~......~........{.....~......~......~.............~....Rich............................PE..L....h.].........."!.....(...<...............@......................................w.....@A........................p1..@....Q.......`...............d...9...p..H....\..8............................\..@............P...............................text....'.......(.................. ..`.data... ....@.......,..............@....idata..`....P.......4..............@..@.rsrc........`.......B..............@..@.reloc..H....p.......F..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\vccorlib140.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):267216
                                                                                                                            Entropy (8bit):6.588374771004298
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:bELZACU+1yBQ3lC9GDBKUW4m0CuQKD2gyZ2KMHWyKMvCyyOaHJ:b43sJZduQKDfKxjJ
                                                                                                                            MD5:8B0AC8B28ACFF4A4D2E73C81D1B87C07
                                                                                                                            SHA1:9D6F157A80F956AA2C1F4D56C8B639E64BEAF78E
                                                                                                                            SHA-256:C213D8F19D6E3646F89F57B35A117CD817D45E475DAE24022B1AA0A9A00500A2
                                                                                                                            SHA-512:43171085B51F974CEAA9F68CA8BCD91AE3017798857A9F104DF883359F2D8D68F802505AE2341AC4938BA25CD0C33E09ADAF3F2DF163D7C827E5F9F5749C67CF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............n.W.n.W.n.W..YW.n.WJ..V.n.WJ..V.n.WJ..V.n.WJ..V.n.W+.%W.n.W.n.W.n.WJ..V.n.WJ..V.n.WJ.5W.n.WJ..V.n.WRich.n.W................PE..L...$k.].........."!................................................................4)....@A.............................=...............................9.......T..pJ..8............................J..@............................................text............................... ..`.data....p.......n..................@....idata...............p..............@..@.rsrc...............................@..@.reloc...T.......V..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Config\Localization\App.ini

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:Generic INItialization configuration [GatherTextStep0]
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2536
                                                                                                                            Entropy (8bit):4.843153305065177
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:rB5TP7ZzQf1v1Y9aVfXwdwuPjRa+c1GYmTp1mTccXd:1dP9IduYGYmTpUTcct
                                                                                                                            MD5:182B94417A7CC0873EB923A6184106F7
                                                                                                                            SHA1:E9A2EEF7949931BD90D60577537EB6183E6EC3FD
                                                                                                                            SHA-256:D8EB752E6BBF0481025F1ABDEC7005775F12E0AF645350C9888ADD89E02D8D47
                                                                                                                            SHA-512:2E48184F21DDA5E3CB9CF64D6179B232AD3C3AE85C8B8AF486777300B95C63799B4F6BC36ED3C18A2D4B3AC1039F4FDF075A8088831855DABA0E7D6BD2ED02A6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:;Gather text from source code..[CommonSettings]..SourcePath=../Portal/Content/Localization/App..DestinationPath=../Portal/Content/Localization/App..ManifestName=App.manifest..ArchiveName=App.archive..PortableObjectName=App.po..NativeCulture=en..CulturesToGenerate=en..CulturesToGenerate=ko..CulturesToGenerate=ja..CulturesToGenerate=zh-Hans..CulturesToGenerate=zh-Hant..CulturesToGenerate=de..CulturesToGenerate=fr..CulturesToGenerate=es..CulturesToGenerate=es-ES..CulturesToGenerate=es-MX..CulturesToGenerate=it..CulturesToGenerate=ru..CulturesToGenerate=ar..CulturesToGenerate=pt-BR..CulturesToGenerate=pl..CulturesToGenerate=tr..CulturesToGenerate=th....[GatherTextStep0]..CommandletClass=GatherTextFromSource..SearchDirectoryPaths=../Portal/Source/..SearchDirectoryPaths=../Portal/Plugins/Online/..SearchDirectoryPaths=../Portal/Plugins/Social/Source/..SearchDirectoryPaths=./Source/Runtime/Online/BuildPatchServices/..SearchDirectoryPaths=./Source/Runtime/SlateCore/Private/Fonts/..SearchDirecto

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Config\Localization\WordCount.ini

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:Generic INItialization configuration [GatherTextStep0]
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):406
                                                                                                                            Entropy (8bit):4.8682639760409465
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:RYvafvWG/uyKFyxNW9tVkuAMrH1Cv/ly8CJd+oUuFuXo8uHMWuA6:avafuGGyeyxmRAMTcvNyV/Uy8o8sjuv
                                                                                                                            MD5:96EC04DB88ACDE6C03534BB21DC33C4F
                                                                                                                            SHA1:98802454B7954AA314AA31104157783CC4E188B5
                                                                                                                            SHA-256:48733147980A8C27DE86F56B8C08A8B4002D61911A45EC26BB3719418FB07BC6
                                                                                                                            SHA-512:92F58E034A7BFD88846DEBC107FDFB7C99E00298283A355AD72D0B75979623ABF4B061FD6EC003A1C53BE6A122AB9DCC807E34A073B69755BBC6914B70EE0A2D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:[CommonSettings]..DestinationPath=\\epicgames.net\root\UE3\Localization\WordCounts....;Write Text Localization Report for Launcher App..[GatherTextStep0]..CommandletClass=GenerateTextLocalizationReport..bWordCountReport=true..SourcePath=../Portal/Content/Localization/App..ManifestName=App.manifest..CulturesToGenerate=ko..CulturesToGenerate=zh..CulturesToGenerate=ja..WordCountReportName=LauncherApp.csv..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Font\BrutalType-Regular.otf

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:OpenType font data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):77068
                                                                                                                            Entropy (8bit):5.564962637120109
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:/xUQ7Pceijik1wQwVnJlxY7eA1qqjRNa:/x/rceijik1S1YKAtna
                                                                                                                            MD5:AFF3816458DB70AB4F77058C0E1C95E1
                                                                                                                            SHA1:3AE85C92BEE209D20076244DEEC96B837D40C25A
                                                                                                                            SHA-256:316E61D5DCAE18705AA4EA45544701D62F71B90C06D28124DD8D27E54362D3D2
                                                                                                                            SHA-512:8482574D9894951371AD015FD6A0A737B00F772A53405131C6E187C7F845EA6F1719DC9314ECD57560F3FA16F7B30760F8521853968223121DF065F65FED858C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:OTTO.......0CFF .dQf........GPOS.Z.v...p..o.GSUBlF.........NOS/28......L...`cmap K[w.......Phead...........6hhea.......4...$hmtx.olM...X....maxp..P.........name>..~........post...2..,.... .........BrutalType....+...................\.....L......."......................$.+.1.7.=.C.I.O.V.].g.q.x............................................... .'.-.:.G.M.S._.f.l.r.x.~......................................... .'.0.9.@.G.N.U.\.c.j.q.x............................................... .'...5.<.C.J.Q.X._.f.m.t.{...............................................#.*.1.8.?.F.M.T.[.b.i.p.w.~.............................................'.3.:.E.N.V.^.h.q.z.................................).8.G.U.a.m.y................................. .,.8.>.I.T.d.o.}.........................O.Znbspaceuni00ADAmacronamacronAogonekaogonekCacutecacuteCcaronccaronDcarondcaronEmacronemacronEdotaccentedotaccentEogonekeogonekEcaronecaronuni0122uni0123ImacronimacronIogonekiogonekuni0136uni0137Lacutelacuteuni013Buni013CLcaronlcaronN

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Localization\App\App.locmeta

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184
                                                                                                                            Entropy (8bit):3.838633147388876
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:wq/AVBukKcIliWLo5/lAW07llzXlSL1SERoll/mVllAlm+SJWljt/ItELitldIt2:wKeVKlM5/lAbhl5EEbm+PmtEG6tE/
                                                                                                                            MD5:AE9ACD1FB33FC98E55DA1A9F92D9665D
                                                                                                                            SHA1:05BEFC38F6A42FA9F6020A083FB484AA6CC7C3DD
                                                                                                                            SHA-256:238C69B3A1C30530DBA8C1E9A9A9E44B99D41CAD2E1F4E26B660A59C881E4EDE
                                                                                                                            SHA-512:9846199C8E2FE67A1163D96A4AB0EA50B8EB070013B7E061269CBEB73739777C4D2B16D9EC1DC91938978EAEA8009975DABB6C9A4C537EB9A0E0D34C7994BB70
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:O.L.hHU.lLF.p.P|.....en.....en/App.locres.........ar.....de.....en.....es.....es-ES.....es-MX.....fr.....it.....ja.....ko.....pl.....pt-BR.....ru.....th.....tr.....zh-Hans.....zh-Hant.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Localization\App\es-ES\App.locres

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):119333
                                                                                                                            Entropy (8bit):4.88211447225401
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:AQmafDGWrpfZp5WR5mRQGnAVIUFS58U0Y01EasWcyRZGEQ0x87XQtd9gs:FmafDVXp5o5mRQLVIUlpG74ZGE8qv
                                                                                                                            MD5:81DE46A9B58C43129003132F36004C35
                                                                                                                            SHA1:20E73629EB4AF646D37240B10BBC382B43A4B755
                                                                                                                            SHA-256:CB551780F80744B5D4F4F64C98B2539DB390253E912B0A94F7722D1ACA85E168
                                                                                                                            SHA-512:7B5779401CE831FCE66A92FD7EEEA32380C47FF87D0FFA0AFD4D25F45CBB0059FB62CB013C6F6A7A89535B08E58380091905463F4F06B018F8116DF9E38AB21A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..tugJ..J....7..........&...=............k......h....FriendToastAlreadyRequestedFmt..R.............FriendToastPlayerBlockedFmt.........b.......DownloadComponent_Required............)...SystemRequirement_ProcessorCoreCount_One..^X.....4...(...SystemRequirement_HddAmount_Recommended.@s.g....`wW.'...SystemRequirement_MemoryAmount_Sixteen..W.Z.....D.#...SystemRequirement_MemoryAmount_One.F.......E..^)...SystemRequirement_ProcessorCoreCount_Two.~.'T.......$...SystemRequirement_HddAmount_Minimum..Fo.......x.....LocKey2DAssets.............#...SystemRequirement_MemoryAmount_Two..5.......s.Z*...SystemRequirement_ProcessorCoreCount_Four.0..Q......+.$...SystemRequirement_MemoryAmount_Four.V..~....?9..+...SystemRequirement_ProcessorCoreCount_Eight....Z....v..%...SystemRequirement_MemoryAmount_Eight...{....W?tE....CabinedMode_MessageLink..{........l.,...RunningWithMissingSystemRequirementsWarning.N.=.....;C......ProjectFilePathTooLong...R.......Q&...FriendRequestNotification_Description....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Localization\App\es-MX\App.locres

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):121870
                                                                                                                            Entropy (8bit):4.89970118059248
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:2QlYqCMWiQRv1dF19AiMXG9yeCBWVXCK+AHtKfArb/ixOsVJT:rlYD7RvXF19T9y4RUAnIr
                                                                                                                            MD5:C403A2BDE9FDCFA5C331031EDD65C2A5
                                                                                                                            SHA1:80A28C1CFD60F121B17FC6E39CB541B19BAEAA53
                                                                                                                            SHA-256:D57FABF9D27001EB040D171232AC7CF7CA6A02E033F23B1723B58C191C82D4DA
                                                                                                                            SHA-512:06AEF3C80E4B9F89FFCA0D594515BA546042E4AE2A92DB4070302C27ECFCFEA0CE85BFA29DAF3F112692C12DC26419D686635766E91A8DD030D7DCD34EFB9320
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..tugJ..J....7...".......A...>...................h....FriendToastAlreadyRequestedFmt..R.............FriendToastPlayerBlockedFmt.........b.......DownloadComponent_Required............)...SystemRequirement_ProcessorCoreCount_One..^X.....4...(...SystemRequirement_HddAmount_Recommended.@s.g....`wW.'...SystemRequirement_MemoryAmount_Sixteen..W.Z.....D.#...SystemRequirement_MemoryAmount_One.F.......E..^)...SystemRequirement_ProcessorCoreCount_Two.~.'T.......$...SystemRequirement_HddAmount_Minimum..Fo.......x.....LocKey2DAssets.............#...SystemRequirement_MemoryAmount_Two..5.......s.Z*...SystemRequirement_ProcessorCoreCount_Four.0..Q......+.$...SystemRequirement_MemoryAmount_Four.V..~....?9..+...SystemRequirement_ProcessorCoreCount_Eight....Z....v..%...SystemRequirement_MemoryAmount_Eight...{....W?tE....CabinedMode_MessageLink..{........l.,...RunningWithMissingSystemRequirementsWarning.N.=.....;C......ProjectFilePathTooLong...R.......Q&...FriendRequestNotification_Description....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Localization\App\ja\App.locres

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):96201
                                                                                                                            Entropy (8bit):5.965906430803618
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:59COX/vRAudmajyXjsjEaW8rg7huwIY+OjkA6R:nXhAa+XjsjW8rg7hXwOjkAA
                                                                                                                            MD5:F1826B51C9D2F78884D8F2FFF6E911BA
                                                                                                                            SHA1:25837F87D53D6BCBB27AA8390BA416AB1C4CCFEB
                                                                                                                            SHA-256:C7EA1F4A5BC78EFF83A4186A655C92CB2A46AF83292BECE45AA25CA369B85596
                                                                                                                            SHA-512:51FC34BD3C169C332EC9D730823B55AB66FB55FDDF6EB79DA1B4012AD40862612D641493B87365A2DAC2363368D28F2398E779FF798CC2722CC099FF93918F78
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..tugJ..J....7...........&...:............x......h....FriendToastAlreadyRequestedFmt..R.............FriendToastPlayerBlockedFmt.........b.......DownloadComponent_Required............)...SystemRequirement_ProcessorCoreCount_One..^X.....E..^)...SystemRequirement_ProcessorCoreCount_Two.~.'T......x.....LocKey2DAssets..........s.Z*...SystemRequirement_ProcessorCoreCount_Four.0..Q....?9..+...SystemRequirement_ProcessorCoreCount_Eight....Z....W?tE....CabinedMode_MessageLink..{........l.,...RunningWithMissingSystemRequirementsWarning.N.=.....;C......ProjectFilePathTooLong...R.......Q&...FriendRequestNotification_Description..........WC"...SelfUpdateNotificationDescription..*vP....!.~."...NewEngineNotification_Description.io..........%...VaultNewItemNotification_Description.........%.......ProjectPathTooLong..g......z...&...LibraryMyProjectsTutorial_Description....".....$..#...RealIdVerification_VerifyIdCommand.........8.......RealIdVerification_Title..}.......|.%....AcceptEulaUserCommand_N

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Localization\App\ko\App.locres

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):92529
                                                                                                                            Entropy (8bit):6.182706569771407
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:3vxBPg7imb9TFqZurLiY2xIIM4E+vxW+rCqmmkaheuVBFS5XFb1N:jPKP9po8LifbEpBmtheuVBFS5XFbH
                                                                                                                            MD5:59D496A88AAC240DFD07EBA428BB81F6
                                                                                                                            SHA1:E86A5BE876415E46B910986B4B9BE79BF1203596
                                                                                                                            SHA-256:68131D7805655542AAC873CE3563968F1531163216C267025AC0BA9738E1A4C3
                                                                                                                            SHA-512:8D29AEED681E49A76AEFB43C202588E97043269453916E8547E1CEF6D3C4EB22BC7965BADEFA30397EF00C8DBD165D3FEFFA99600E9CC3A710DF6050A71E983D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..tugJ..J....7..........+...<............f......h....FriendToastAlreadyRequestedFmt..R.............FriendToastPlayerBlockedFmt.........b.......DownloadComponent_Required............)...SystemRequirement_ProcessorCoreCount_One..^X.....E..^)...SystemRequirement_ProcessorCoreCount_Two.~.'T......x.....LocKey2DAssets..........s.Z*...SystemRequirement_ProcessorCoreCount_Four.0..Q....?9..+...SystemRequirement_ProcessorCoreCount_Eight....Z....W?tE....CabinedMode_MessageLink..{........l.,...RunningWithMissingSystemRequirementsWarning.N.=.....;C......ProjectFilePathTooLong...R.......Q&...FriendRequestNotification_Description..........WC"...SelfUpdateNotificationDescription..*vP....!.~."...NewEngineNotification_Description.io..........%...VaultNewItemNotification_Description.........%.......ProjectPathTooLong..g......z...&...LibraryMyProjectsTutorial_Description....".....$..#...RealIdVerification_VerifyIdCommand.........8.......RealIdVerification_Title..}.......|.%....AcceptEulaUserCommand_N

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Localization\App\ru\App.locres

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):127055
                                                                                                                            Entropy (8bit):5.417477440001432
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:8SAaPqDPrGIuxlYqSGuYQVIP9KYuS39DoMXZqLGoeL8gXB:JAayDqIclYqLQVIP9hNDRpqLPeL8gXB
                                                                                                                            MD5:130C021FF0CD4E1FC3F75205078EAA90
                                                                                                                            SHA1:1B66E0B940F54F91D7B774B2D27348500FDC6814
                                                                                                                            SHA-256:AE737ADEE34C768E933C6830496B90CBA482F51110A7F3D98E74F5054ABDD298
                                                                                                                            SHA-512:5C1AF0FD3DFA66DFA91B4D5FFDB82503866A5F680EC0933D1291377FBA3FF6B852007E04D9208E9C7B57B73A8A20F7E7171DB777DC1BFBE645C011A8B9FB0943
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..tugJ..J....7...........:...:............r......h....FriendToastAlreadyRequestedFmt..R.............FriendToastPlayerBlockedFmt.........b.......DownloadComponent_Required............)...SystemRequirement_ProcessorCoreCount_One..^X.....4...(...SystemRequirement_HddAmount_Recommended.@s.g....`wW.'...SystemRequirement_MemoryAmount_Sixteen..W.Z.....D.#...SystemRequirement_MemoryAmount_One.F.......E..^)...SystemRequirement_ProcessorCoreCount_Two.~.'T.......$...SystemRequirement_HddAmount_Minimum..Fo.......x.....LocKey2DAssets.............#...SystemRequirement_MemoryAmount_Two..5.......s.Z*...SystemRequirement_ProcessorCoreCount_Four.0..Q......+.$...SystemRequirement_MemoryAmount_Four.V..~....?9..+...SystemRequirement_ProcessorCoreCount_Eight....Z....v..%...SystemRequirement_MemoryAmount_Eight...{....W?tE....CabinedMode_MessageLink..{........l.,...RunningWithMissingSystemRequirementsWarning.N.=.....;C......ProjectFilePathTooLong...R.......Q&...FriendRequestNotification_Description....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Localization\App\zh-CN\App.locres

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):119457
                                                                                                                            Entropy (8bit):4.8400705953091085
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:9a3oweT5TU24z73qnokLB6Hs2pHheUnafDVQFb:9a3of424fqnBKsQYi
                                                                                                                            MD5:B79BE4CFB5AC286876995C832210F30B
                                                                                                                            SHA1:69FEC01EF80E5D8916C25F9CD56A6472D7340853
                                                                                                                            SHA-256:537BBC99405DAF3533EF491BEAC34A9955F80085F3BFA036DC22EE0D0EE11649
                                                                                                                            SHA-512:FC0C5B38CD8B2DDEBE8B5732674EA8A93DF64FACEB983F27001B8FB0E70472B763CD7D08F52A28AEC52A2549DFF19528217FB5AC24C36A445CDFC630D5F0C134
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..tugJ..J....7....R......N...............S.C.l.o.u.d.S.a.v.e.C.o.n.f.l.i.c.t.R.e.s.o.l.u.t.i.o.n.I.m.p.l._.T.i.m.e...G..........S.t.a.t.u.s.S.t.r.i.n.g.F.o.r.m.a.t...G..........F.r.i.e.n.d.T.o.a.s.t.A.l.r.e.a.d.y.R.e.q.u.e.s.t.e.d.F.m.t....R..........F.r.i.e.n.d.T.o.a.s.t.P.l.a.y.e.r.B.l.o.c.k.e.d.F.m.t...............P.r.o.d.u.c.t.N.o.t.i.f.i.c.a.t.i.o.n.B.a.d.g.e.0...G..9........D.o.w.n.l.o.a.d.C.o.m.p.o.n.e.n.t._.R.e.q.u.i.r.e.d...............A.s.s.e.t.V.e.r.s.i.o.n.S.e.l.e.c.t.o.r._.N.o.V.e.r.s.i.o.n.S.e.l.e.c.t.e.d......s........N.o.t.i.f.i.c.a.t.i.o.n.B.a.d.g.e....@.i........O.n.e.C.h.a.r.a.c.t.e.r.O.v.e.r.L.i.m.i.t.F.m.t...$..........S.y.s.t.e.m.R.e.q.u.i.r.e.m.e.n.t._.P.r.o.c.e.s.s.o.r.C.o.r.e.C.o.u.n.t._.O.n.e....^X.........F.r.i.e.n.d.P.l.a.y.i.n.g.....R........S.y.s.t.e.m.R.e.q.u.i.r.e.m.e.n.t._.H.d.d.A.m.o.u.n.t._.R.e.c.o.m.m.e.n.d.e.d...@s.g........S.y.s.t.e.m.R.e.q.u.i.r.e.m.e.n.t._.M.e.m.o.r.y.A.m.o.u.n.t._.S.i.x.t.e.e.n....W.Z........S.y.s.t.e.m.R.e.q.u.i.r.e.m.e.n.t

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Localization\App\zh-Hant\App.locres

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):84403
                                                                                                                            Entropy (8bit):6.163657449592362
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:wvAGLKHjLubVLugV4uBj2iIVxUsuyIBfR3DLWm8m:PGL8+b5us4qLIVxUsuDR3DLWm8m
                                                                                                                            MD5:3C92003E50D2B24B4A9A627B2F47E9FB
                                                                                                                            SHA1:17FD18C4FAD3C83C872E93A63D85E0D6DC67EA10
                                                                                                                            SHA-256:1EBE495E88B2B897EB5F84CD2E10598761F80803C4033CEDCDC86EA7C30B9223
                                                                                                                            SHA-512:5D5D017B9BD5E8869CD6ACA08C32FC188F37EDCCF00BAF9952532BD2E60E6E94DC5D93F4923D9D47CF8582578EA3FF95EFA3A319DEF4B05EF9698B93FFFC6F0F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..tugJ..J....7...L.......?...A............}......h....FriendToastAlreadyRequestedFmt..R.............FriendToastPlayerBlockedFmt.........b.......DownloadComponent_Required............)...SystemRequirement_ProcessorCoreCount_One..^X.....E..^)...SystemRequirement_ProcessorCoreCount_Two.~.'T......x.....LocKey2DAssets..........s.Z*...SystemRequirement_ProcessorCoreCount_Four.0..Q....?9..+...SystemRequirement_ProcessorCoreCount_Eight....Z....W?tE....CabinedMode_MessageLink..{........l.,...RunningWithMissingSystemRequirementsWarning.N.=.....;C......ProjectFilePathTooLong...R.......Q&...FriendRequestNotification_Description..........WC"...SelfUpdateNotificationDescription..*vP....!.~."...NewEngineNotification_Description.io..........%...VaultNewItemNotification_Description.........%.......ProjectPathTooLong..g......z...&...LibraryMyProjectsTutorial_Description....".....$..#...RealIdVerification_VerifyIdCommand.........8.......RealIdVerification_Title..}.......|.%....AcceptEulaUserCommand_N

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\Arrow-Left.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 25 x 42, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1308
                                                                                                                            Entropy (8bit):6.852237502717288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:e/1hpunQWwjx82lY2T32HEVRzDZzLyJ3VuCzq3nz8GtT+8YxwEhraTSoH2:eNitNn2V/ZGJ3wwS8EY+qaXH2
                                                                                                                            MD5:4612417B04BD2AD36428505187C670B9
                                                                                                                            SHA1:ABFAD8FF9C2AC5B0CCC7891C3BD593C7C28918F1
                                                                                                                            SHA-256:8A2A175258525E35F3938F621342D6B3F0B6D4F4AD181C428C50D8F832F8A161
                                                                                                                            SHA-512:3BFC0A9B7F7C2A95966431E4E03AC6419F76D207C74AE412775CACC2F8B15E54DEF22CC2BFF5FC6FF9FD120774233E8FC77709D0BAB517093BD3457635441639
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.......*.....F..`....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:7D505AAE216D11E4A91EE223E65513C3" xmpMM:DocumentID="xmp.did:7D505AAF216D11E4A91EE223E65513C3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7D505AAC216D11E4A91EE223E65513C3" stRef:documentID="xmp.did:7D505AAD216D11E4A91EE223E65513C3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx...GCQ....=......=..$z.!.S.Co...#..........}.1J).%..f.0.....9.....s...>v.....1&...(+...rI...0.!U.._/

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\ArrowDropDown.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1200
                                                                                                                            Entropy (8bit):6.522679056200555
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:b1hpunQWwjx82lY2T32HEV+bKdPLyJ3VOZiKnSbGHxpp2t7OCaFKhax:BitNn2VYQeJ3MZzkazMt46ax
                                                                                                                            MD5:15340F70A977D657E6254C6D459B558C
                                                                                                                            SHA1:6AD8615CF148BBE43E3777869A9861DA05FA2313
                                                                                                                            SHA-256:7F3E73F1EB832E8D2F0B6DFE1C284C62B979ADF1CAA3EBA518B5C75A718248CD
                                                                                                                            SHA-512:54ED8B528EABCB718CB67BF69803292377379A88A15BD8161187F8A61E7610257C92BD5852C5D958E91FEF3DB3387A19DAC8BD4F6E8D552FDE224987390D8E7C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B8C02CED643011E4AD80B6C79874A8A2" xmpMM:DocumentID="xmp.did:B8C02CEE643011E4AD80B6C79874A8A2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B8C02CEB643011E4AD80B6C79874A8A2" stRef:documentID="xmp.did:B8C02CEC643011E4AD80B6C79874A8A2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......&IDATx.b...?.@.&......u.....q..1..d/#..e.f..@.....s....`..f.......O.p...A..a. .HG...,...:...@.....b......ak .DC.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\Checked_Box_White.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1147
                                                                                                                            Entropy (8bit):6.441055684423205
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:+Ny1he91Wwjx82lY2T3ouVv6qyJ3VoPbNGFvrFESm59PZVcXomB:+NwqQNn2xeJ3+uRbmPPgXR
                                                                                                                            MD5:7885B14CE0D508431FD97F70FF163E19
                                                                                                                            SHA1:07BA0210373A4DAA9C9F48824434420280EE78AC
                                                                                                                            SHA-256:B0383F31C5E936A65B5BC9B319653183FF2FCE4D73EFC41AAB1A3CFBF42E4A99
                                                                                                                            SHA-512:3B2888E552ECB0591A0AE5E0AD774F1C4B92B38A2159CCDD9C9614856920FB2E66EEAD2DAFB189CC95460180E8F3F368DD825CB73B2681290F8EB667B363ADD0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:724E60DBDCA311E8985EB71D4E896818" xmpMM:DocumentID="xmp.did:724E60DCDCA311E8985EB71D4E896818"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:724E60D9DCA311E8985EB71D4E896818" stRef:documentID="xmp.did:724E60DADCA311E8985EB71D4E896818"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>S.......IDATx.b....,......T. ....T4.......W(0..cdC/.......c01...:C......j... ..bAj.j.........{J.u..@|.....5....`,..@

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\DropShadow_Top.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 2 x 9, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):952
                                                                                                                            Entropy (8bit):5.898560237037919
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:Pc1hpunQWwjx82lY2T32HEVjCWyDoyJ3VjXYby5pGXyB:6itNn2VhCrDrJ3hoW5pP
                                                                                                                            MD5:9EA3823084C8861B90E8AB46F1E8E882
                                                                                                                            SHA1:73091B6F2B1EB73C7B7FB33D58ABF2204D5875AA
                                                                                                                            SHA-256:8903EF0C460D236F8537239E782BD020C3B3C27465ACE95E0FDCA0C9139C9B8D
                                                                                                                            SHA-512:489BE43AAB515F7895355C34041CB921B477A2A012287C72BD6122B396430E151786B70404E8B43DA571347187A1073ED963D212CE28F5ED3BA64B7AC3FE6D3F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR..............q......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D3A0424499F411E4B7CBF0B49906AA48" xmpMM:DocumentID="xmp.did:D3A0424599F411E4B7CBF0B49906AA48"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3A0424299F411E4B7CBF0B49906AA48" stRef:documentID="xmp.did:D3A0424399F411E4B7CBF0B49906AA48"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>1.......IDATx.b...?..31@........,@.7H....1Da.).C....0..c...g.*....IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\FocusedDark_Square.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 41 x 41, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):229
                                                                                                                            Entropy (8bit):6.527961559934967
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:6v/lhPyWwX6Z6jYt11TnBvj1bx+TKlbllbp:6v/7EVYtbTnBvhbx+TKlBz
                                                                                                                            MD5:8A41D73F05DBFD9C896AD205B9FA3BD0
                                                                                                                            SHA1:8E331B99A4002DA9A90D3FD4DAEDF1E590CC2D46
                                                                                                                            SHA-256:C20DC130A6BF7B81EE61FA5DE42A811C65450B7B62DD4DD7A4A63F4AD8666BC3
                                                                                                                            SHA-512:46EB19D23B8196D8C8E98271B06836CADF4473CF5040EFF60EE1FE229A69BBACA75CBE681899E76D6514C1B44DDC078DAA79CE69642804BF6A1F91DBA1DA9CE6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...)...)......`......gAMA......a.....IDATX.....0.EQ.J.....I.}<O....7.n...Q...6.>...}}<.Z&...9Z.W?......c..9^.P...d.I(dDR.2.$.2")..G.......#...HJ@.BF$% .HB!#...y$...I..<.P...d...u.Qyy....i.d..m.....IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\GoOnlineButton.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):230
                                                                                                                            Entropy (8bit):5.613616744686092
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:6v/lhPKwMDlM9RBNSZg7FJeFVD1rm4bbp:6v/7iwM5+BEcze1Pb1
                                                                                                                            MD5:F553CF85D9C29DAF80FCCA53A43C5AAE
                                                                                                                            SHA1:5936DE26F656CF3A44560215F7D4C7DC175E512D
                                                                                                                            SHA-256:F583EAA3F6579C19D0DE91DCCAB376324EA0BE5AB9DA5FDE5CDC303873338075
                                                                                                                            SHA-512:06E1B4187D70F71969C7E3EB23C13E5A9EAB980BDD2DF70F3B9961D1C40D2AF8FA223414E0295F16456BDC0BCE361CD8578F11EB4A927B45C374BAE2CB8BBA57
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR... ... .....szz.....gAMA....|.Q.... cHRM...........R...@..}y.....<.....s<.w....pHYs.................tEXtSoftware.paint.net 4.0.9l3~N...8IDATXG..1..0....`{m.o........$.I?PUw......................)n|N......IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\NotificationClose.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6262
                                                                                                                            Entropy (8bit):5.889952628677394
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:Yald1dRXtmgkrQR5a1jf6Ok0ISrwx4at2FiSaeg:Yk/Xtm7ooTkPLZSaeg
                                                                                                                            MD5:325118DE442B5F74B2345063434E9A96
                                                                                                                            SHA1:E14435404EC45ABC9DCED55681B819E7A4CA48EE
                                                                                                                            SHA-256:C934856C3B8C401C7CE6CE51AF18B789045CB7697D2A6DF012EF357F8D27BEB4
                                                                                                                            SHA-512:95567A22871E909045B772EA545C77BD8931535517B2EF7B40CC77D7B2DB042CA0B31B5FB4CB4DFE8B93519F3A86FFD7684C0AF065B7BD0B51300BA0C02D3297
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...<...<.....:..r...(zTXtRaw profile type exif..x..X[.#+..g.....@..y..........>..,'.$.........|.Y.YJUS..d..:5^.v...........!.......8=.\MCO>... ..,...tk..y......z@..vm+...q.}].......o.........`.Ni1q.=q..`.R....N\11rE...]oa..3.....;+..}1.F..;....`..t..m.....v.X.e\.mUo .w.Y....]..H...c+......yMq.|..r..U....|..;.AF..l.4..u.A.*.RA...Q>V.$K.a.../..........MO].kg.A..O..D.Fx#.....KA{.......z%w.......@......q...W..r`..`....n.r;.C4c...|....".-P...D%.R.%.B..+.i.T.4....I.Z....9....w...I.5...".....3......)....d.Q)R.)kVQ...Z..-..b.U..J.Zj..j.d..(.V..YkX.Ar....Z.s.]...k....g.!CG.5..m...qb.,.N.m.)..d.*..[m..6.e...n..........F...a.'.'kx.....p"...K..xq.`..9..rN..s.%x.$h)N.$g...EI6=...s/.......`.8u.....}...}...p7"...........T.'.o..W_.+.?&h..%c.e.4...xpB....I5.;.!.T....J2..oB..{..7\D3.}Ju#..V..p.,..:.......5By.Z.^esFD..O.D.k..x,...^N...66..H..+!#..3.9{..@)...).ge.................Q,|...*..T.....v.EC..kl..}..{.]Pj...x.pF..,..@....6....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\Play.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 14 x 21, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1061
                                                                                                                            Entropy (8bit):6.266755375918276
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:K1hpunQWwjx82lY2T32HEVm5Y06yJ3VRQhm/GEJq/4A2:oitNn2V2rBJ3YM/S/u
                                                                                                                            MD5:140D150202BC33B3353A233A5DFC6950
                                                                                                                            SHA1:E8353A4C3FD5F36BFE45023E2E1DC194A3EB0771
                                                                                                                            SHA-256:0BF3ACA3A64423B475B2A6FF1CAAC44E842E5122303A391F5E4EA2106DEDBD4C
                                                                                                                            SHA-512:91A348DF2CD684E3839B2F06767F26D3892A00A1AEDE12C3A828A6499D51619BC90D6F5D5388C863A047E18965AE5249F8E7D0959FF107E27D819D6D9B194A8E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.............vY.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:8543B8555E2411E4B6B68E73DD3D623E" xmpMM:DocumentID="xmp.did:8543B8565E2411E4B6B68E73DD3D623E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8543B8535E2411E4B6B68E73DD3D623E" stRef:documentID="xmp.did:8543B8545E2411E4B6B68E73DD3D623E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.%'I....IDATx.b....8.3..A..T......1.9.A`/....n...9.A...[....~.q.9.a..\. ..=......X... p..9A.......8....yD...[-R.x..o.j\

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\Social.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1470
                                                                                                                            Entropy (8bit):7.021929820030502
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:b1hpunQWwjx82lY2T32HEVh706ynyJ3VhJ0wMzAG9YbCB7zyKmrpCx+uJdGXSC38:BitNn2Vr7iyJ3rJ5OArFA4uJdIpu5
                                                                                                                            MD5:F22AE42B558FE179842B476FA6253FDD
                                                                                                                            SHA1:6682961EE769C50D28D0C8BD4AE6FE969F1BB566
                                                                                                                            SHA-256:EF078450D1673A559D16016EF68C01A1DFDBFFF5D7414A1CD69B01F9D675BB68
                                                                                                                            SHA-512:0FFE68CB85E164BC22E6134673C49845C4F0B0C5FD4E36A40C9872A62269780DC34FCB462D079A2062AA269E3E86B50CBD7956D01C668D5DE6B4B0D26FE6647E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:1E46F869B62A11E49DFA9DEA806E1BF9" xmpMM:DocumentID="xmp.did:1E46F86AB62A11E49DFA9DEA806E1BF9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1E46F867B62A11E49DFA9DEA806E1BF9" stRef:documentID="xmp.did:1E46F868B62A11E49DFA9DEA806E1BF9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..^....4IDATx....KTQ....J.C..G.EAd-l!H."n...E......]B....;....\....!-LJ.A..7b..?.5...^8...;.M....G.s....w.3.y^.<#.9..4

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\SocialMediaIcon.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 54 x 58, 8-bit/color RGBA, interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1595
                                                                                                                            Entropy (8bit):7.857832835145131
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:5EITRneJp7WkNY6N1CWRxRoAAM+xyyQa5:LTku6N1CWxnq4yJ5
                                                                                                                            MD5:9AFA3988952640A2B3B8FB76D67D316B
                                                                                                                            SHA1:5E5C351DE9DBFCD4F3C353EFA31207D7BA3DE1BC
                                                                                                                            SHA-256:54C817007F95EEF76F0AD04F439A45BC4D390DC6D7E81F9F85476247C5FAE0AC
                                                                                                                            SHA-512:D30BA91B287945AA7B783DF0DACE8B54D1FFDC5361D8673E1828814CA371C98306AA0FEBA627019A562A976B13FD2B123B7F8022B9EAB3B62B662B945F3C6B6C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...6...:........0....gAMA......a.....IDATh..k..U....|..v..$..D.(E*.......=.p.....(H......I.%..B.....Z .`.A...V...<....>g.=3{..x6,...._k.3{.....i.F.!..=.>....(.N..K..G..`(.4.DL.!...1.lZ..U.....X.)....B..6.oY6....c{p.q......7h...!......c.H...-..8.C.N.])i.o5..B..X..EFv.H. ...D....g..brgX.F..t.s.....j&. ..$...u....s...t"...(..R0MB.74n...^A..).......$[:........c.t.-S.(.}.<..qR."V.Xf.B.A+`..)..z9.L.v.`...6u.;...:h.=.}!.A6.......N|H4....`.8.3..<....U...Em;.C...lh....D..ek4.....^[".n....>.d.6...-.(......S..B..Y.h.j..UN...8.p........s.5....0.>.l6.z.K,.a.56...h.......+.3.*..Y}.K8.x2)JJj.......$|[.-...*.lj...:.......x..k...../.%;.h...T..........f<..`;..}.h.n...;K7+.%G..k.P^...8.....J}PD.G..~.9K@.k.0.......o.H.=..~VL....=6.C.Bk...N..GzXo.../.f..Pd...0..".>[.k..m.'/".c.....`z...T...(.=rm.m......k.-..v..g[.-.1G.....[.#.....2^h.....z..^....6.y...R....m..S..l...c"...P....D..T.<\L.UyUE...X.z..i...s.4..m].`..i.....:.Qq...p^2....-..eT.....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\SteamLogo.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 94 x 19, 8-bit/color RGBA, interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1676
                                                                                                                            Entropy (8bit):7.848625343220426
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:nZWHX5qIjr++shQUQ6mLiGJEiAAy0VqPm4SW8Rme9apoaN1/o6Y/ktJr2HyzJLp4:ZOs+sWUxxGJEHxz0megp1g6RnSHOJvx0
                                                                                                                            MD5:5A3AA6D5FD9C8C443E826359E816ADC1
                                                                                                                            SHA1:0F4F3D89372A577C11BF1342A29B3C214F5C9F6F
                                                                                                                            SHA-256:56938F614AE3F54A4525DEE3FC5C0CFA0FEE4EF362E051FA0CBDE164AD27CCA8
                                                                                                                            SHA-512:962871E2853FBE60310CA5E99FD8717EBAD68BB09D5E115921B2DB464A9DECD3672186727AA5FDFC647C1AEBA5F9BC2653A116997ABAC6BA5EA4156DBE65185E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...^.........n..J....gAMA......a....CIDATX..[.UU..=j.%HiE>T.......`.L....T....EX!i=.......B!.b&.F^(H2..HS.Q....c.W.?...=.\..c...c.1...c.5.........o..xZQ.7...O..Fz..G.<WZ......dl.z.C.wR..!.x.?,...RW...c.&<a1MI..P.q.$........_`.............Ne..((....l.pr.\v...G..._qP.7.n....d....Vs.;T....q..1|N..g...h..a...6.n..b........uAl........t.4Q.]...L;.b..Ic}..].,.=6.FAwB.dp..?..G.u..H.........t..%...5*.GNy.&..[..Pg&.7..5.$./&o.V..5..uu.e..Qk..[.....:.i.q.f..%..&.u/.....O.z$...~I@U].0A..g.w..Z.o .U>..E.$..o..2>..[.".L..."z.0n...r.uK..q=..y....Ekp.8.]`=:...?.G.-.m-.Y..dg.;q......;Z..'uzZSX?.]..~3......\..u9g.juy..sM....|E:.... B...&......#..<.^Q.J..p.#i....nOI.!.,...TkK\..v.E].i......V...<.(,.^..P."F.w...R?.8...r..4.w2.K...);p.F..G.:.!z....}.q=.;M{..'YlmJ.....@..G'|..q....??....n.s6.ol.i.O......j.......7.@.Zbx.W...V....h_.d~...@...M.....[/.y.os..>....I8@.M.....>....ZE.x...S.!.6j.2.X.......&;.M..9.qC..+.x]N.7...\.vz...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\White.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 8 x 8, 8-bit/color RGB, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15605
                                                                                                                            Entropy (8bit):1.8831790296550144
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:mSZEZkIt+WsNXrNXpdns6l2sc5GvqRtmLvI:mSmkd5CRtmLI
                                                                                                                            MD5:FC5FA847162FC6C31CFC24BB049BA84A
                                                                                                                            SHA1:DB6D23032621FD0CBC63BCD5ECD87268A7E77332
                                                                                                                            SHA-256:4A8A8525313022197A961D3B7A5950AEE6CC414EA1D8DCD7DA8508ED714DD740
                                                                                                                            SHA-512:86A699D552C8CC132952A12DF3E3CCCA8D734C4660015882C36DE1D9C563DA6F8B86D5A64D254094ED2398281AC54436150FACA786768926684B0E5F957848B1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.............Km).....sRGB.........pHYs.................tIME.....3..,:a....tEXtFile Name.White.png4}.<..<.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.352624, 2008/07/30-18:12:18 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/">. <xmp:CreatorTool>Adobe Photoshop CS4 Windows</xmp:CreatorTool>. <xmp:CreateDate>2014-02-21T18:19:21-05:00</xmp:CreateDate>. <xmp:ModifyDate>2014-03-01T14:51:08-05:00</xmp:ModifyDate>. <xmp:MetadataDate>2014-03-01T14:51:08-05:00</xmp:MetadataDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:photoshop

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\button_flat.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 43 x 43, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1139
                                                                                                                            Entropy (8bit):6.47905972130423
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:Iq/1hpunQWwjx82lY2T32HEVeVA/Y3AA/6yJ3VeZRA/h3iA//GqDbo/6sNLb:IqNitNn2V58BJ3UOD/5oisNX
                                                                                                                            MD5:C38617EE73FE155567AF4A7D7EFD8675
                                                                                                                            SHA1:B038824631377FDE0068B3237753E9D6C42CFE9C
                                                                                                                            SHA-256:C741CA0B9D39ACC15F11BB95100EE3FE43BC3B322704A1AD4F7D65BCF0A6C9EB
                                                                                                                            SHA-512:B4E38294C56096FCAADE8DD871207147A67458A02B26F4002203DA7EB00C13AC69CBF4A7B9B32D5DAB65F8D8E1C0A126C85CE87B34880454474134081B69C638
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...+...+......]q.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:90E90CE3854411E4959FA5CA0374AAED" xmpMM:DocumentID="xmp.did:90E90CE4854411E4959FA5CA0374AAED"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:90E90CE1854411E4959FA5CA0374AAED" stRef:documentID="xmp.did:90E90CE2854411E4959FA5CA0374AAED"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>3.Oi....IDATx...A..P....U7(..A'."<...4.=.. DA....6.?.....f`~....>.=.'af..).A...].3.]:...zD..)..u.6..4.1..o&h.RF.......

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\button_right.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1458
                                                                                                                            Entropy (8bit):6.951576515675073
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:D/1hpunQWwjx82lY2T32HEVfaEyJ3VZbGenjZwxp1/BL0SppYJrgi65:hitNn2VAJ3rxnjGb1/Rorgia
                                                                                                                            MD5:F5AE6ED4F6477623346760A551C76F9B
                                                                                                                            SHA1:59A3650F3646F76B5208EABC90659EE430FEFAEB
                                                                                                                            SHA-256:E816E9578481D8AEF3B1E2AE31C90ACD079CF3E72D1664F65E52078AE09A581D
                                                                                                                            SHA-512:5105246489A77C24D55480E9742E47757767E3D8A08436DEF391EBBE47A1F067B98A61CBBA74495E48B83CFA594C6AA2571D173ED4724EA2578B620A9002795E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...d...d.....p.T....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D0176B67855D11E49C40B2CFB7253C4C" xmpMM:DocumentID="xmp.did:D0176B68855D11E49C40B2CFB7253C4C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D0176B65855D11E49C40B2CFB7253C4C" stRef:documentID="xmp.did:D0176B66855D11E49C40B2CFB7253C4C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.#)....(IDATx...j.Q...{u..bcaa.+../`..m.......y..e+.46..@j....a.;73..FL.........V..?....:..I)e.`].Q.Q.Q.Q..........5.|

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\epic_logo_filled_white.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 79 x 92, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2930
                                                                                                                            Entropy (8bit):7.894013269883458
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:SjhaZ1LxErX1lq2Eu2cCjQV7rxrCzwNKf1D9OXJyD85sN7frZpLBCDDI3Gfix3VV:GEZ1LxErl8O2caEAzz1OyD1Rd3Gaxd/d
                                                                                                                            MD5:7CE7ECD66E505D97AA06DE25E065FD03
                                                                                                                            SHA1:E6EEB2A1AF70189C6D0D082CC85E4B356C2C6A49
                                                                                                                            SHA-256:F17427E900568571D18373B9BA80B7492F08A98F2D26F551CE670378B8A4C29E
                                                                                                                            SHA-512:0D1E9C4DE8A484D58DB820261F86648743C61F5773E87FF70E9F86173F5A50FD59A86281F6939B596E00010874F01B03025898F6BE0E6D81B859E1E5E03E7F5E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...O...\...../v.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.9l3~N....IDATx^.yTU...is.G.s........(.+.....[\R!Q\..T..*.'..b..1Q.K.V..5*....Q......qWx...;.;.e.].{*...|X..f..;3w.wg...v...~.....z/q.xL....+.....7.1..dO..U........La..y........+.A.^....(..)3P8...."..K...TW..xe.@.-..)...*.!.J.d..gH..x!....%^....*+...v..M..;wX..'.w.g.........u.....eHm4....RS..iS...v..'O.y..k.X.!]....};K.<...6a..6`........86rd:;z.%..<....Y.z.wMvv.....]j..?v...w.!..s.X.z$%.lP...m..F........pC...tHH.MLK.x..Zl........q......T..$..z.6.-6n.4.]...^.x..y......7nd..I..4..;w.%...Dsq..G...Q....&Mb..l0""^.fM..2v........qe.....(....o.....5...$..;-.h.....6..`.......;;"".......7k.L..W_m..F>|...;..y.&K8..O.?.6......._2..Q..+,.o...B..N.m../Kx...fk6.vy...._R..P.).x...x.Q.=....22.Z..TogG...UUqO..}.$^$..x...o.N..".W.'.......n...K....F..oFV...b...O......8q.J<....C.Q+.C.$C...U.%K..4j.x..U..(.;..s.[}..+./...x.c[.h..z..;f.......6l.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\epic_logo_filled_white_small.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 32 x 37, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2676
                                                                                                                            Entropy (8bit):7.660170969036157
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:NccNn2yHNeJ3nJ42kg4UohoVoGMHM1K1VQQJCyGZMN8XS3KhHq2y:qk2CMJ42kg49hoCHIK1VQQJJDuX22y
                                                                                                                            MD5:B8CFEAA877203C1CC390786ABCD22452
                                                                                                                            SHA1:06BB5673D5C91EFEA71A291CA67E237B51E3711C
                                                                                                                            SHA-256:3BD7790E029BEFE06EA7FFC09F5914D8040E5DC8334AE1BEA0042C8A96351AB9
                                                                                                                            SHA-512:5052F9C409F59E1952F8E66FBA2360DEDA3C8F04A5602CB10981EE2C01A657B29CE0041374B0C88D1CE071E56134BFF948EBD9AB111E1F310E0496887C0CEAE4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR... ...%.....#..G....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:8F7C94E368AF11E79E4FB3067E1DA3FD" xmpMM:DocumentID="xmp.did:8F7C94E468AF11E79E4FB3067E1DA3FD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8F7C94E168AF11E79E4FB3067E1DA3FD" stRef:documentID="xmp.did:8F7C94E268AF11E79E4FB3067E1DA3FD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..x....IDATx..WiLTW..f...a...d..T.M.iR.Q.-DZM......&X5U.T....V...[.RKj..VP...i.T.b,K-e.....,.....3<d.4........Y.L0

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\half_hamburger.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 22 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1099
                                                                                                                            Entropy (8bit):6.358430554429135
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:Z1hpunQWwjx82lY2T32HEVy8CiyJ3V9j5GI4F1006Bhd/sq:nitNn2VEJ3X5Q0lBhf
                                                                                                                            MD5:3BA7A8430C74F454FA4EBAAA9677EC93
                                                                                                                            SHA1:A75BD23C71BAFC60A0E579F964409E527A39BE93
                                                                                                                            SHA-256:D5B2EDCD835D6CC7FCD584249ECDBFD49DD9DA12EB3F58A440AEFD1B0F3BF991
                                                                                                                            SHA-512:1BF6D8663B64BDD555F85C91CD0CBE4F3BB40D82D8F8B74B23D3D27C86F42451ADB08EEDCBBBAE77AA5DD24016391895E6B82C5D002DFBE38C4F610FC7273650
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.............(..V....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:2E7F084A5AF611E4BC4491B51F92CE1D" xmpMM:DocumentID="xmp.did:2E7F084B5AF611E4BC4491B51F92CE1D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2E7F08485AF611E4BC4491B51F92CE1D" stRef:documentID="xmp.did:2E7F08495AF611E4BC4491B51F92CE1D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>>.......IDATx.b....[...@|.....JF.......ie..Z.....6.-.....$.P. Fh.x... ..c.*&..P...i.w....c.....&*..i ...i.AN.q..r.rZ...V

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\sd_close.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1091
                                                                                                                            Entropy (8bit):6.337161164733769
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:C1he91Wwjx82lY2T3o5VrTmHaikyJ3V4Pg9GDt9avM:AqQNn2q1mrXJ3KI9KPavM
                                                                                                                            MD5:4512DB0BD5BFE6B3F2ABEEB72A9308A9
                                                                                                                            SHA1:F90E36F57CD93EEDA1E644EFB6D985DAAE230B12
                                                                                                                            SHA-256:F829592A3039EB2D4F8C88881BA2595FD3BC13B44CB7B34E862CDBFC194E4968
                                                                                                                            SHA-512:E8B72F5A7DE7B145036CD36A8F90BE6507EA9D76CA9C736EC67048BF00AB95A0CBD4E04E1135686355B8C58D62285E876846D9313685AD42BF9FADE49FB00E0D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.............;.J....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:95E501AE0B1311E6A5CA9034D96D6F9C" xmpMM:DocumentID="xmp.did:95E501AF0B1311E6A5CA9034D96D6F9C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:95E501AC0B1311E6A5CA9034D96D6F9C" stRef:documentID="xmp.did:95E501AD0B1311E6A5CA9034D96D6F9C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>6..]....IDATx..... .....;..x.1F.#(x(.'.2.m.6...I..zD.y;.....RJi#.j....A.8^p.}V .}!B.....S..\.H`c...x..1.'..... ...

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\selfupdate_continue_hover.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):341
                                                                                                                            Entropy (8bit):6.932688186850299
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:6v/lhPfiCCCtdoRg7NStAkIdh7mBkCuTQdn5qJ0T9nFysXrvEp:6v/7xjtSUVieCumn5/9n82C
                                                                                                                            MD5:716B15F76294EE5D320BA95F66246340
                                                                                                                            SHA1:DB1098FE9B1E13C7339F35F3BC646907F1B21A63
                                                                                                                            SHA-256:6FB23EC5112544188534C03191DA2A5F7148D574FEE3DFEB353AC28EE176A7DC
                                                                                                                            SHA-512:0811F5EE3AF9FCCF8110A32A440A2170984597A98657C06AEB42C011B4A69BF9F2FE82F5384B2FDE78C1292FF2172D23762571E986D70AC22B23E56E7A50C5FC
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...............c....gAMA......a.....pHYs...........k.....tEXtSoftware.paint.net 4.0.134.[z....IDATHK..M..0..9....p...3.y...a......X.....m...-.iB....8.....I.v....)6..N.&~..._4{k.[q...8.YE..].x....v.!..y..0..XS.s.L..B.&....O"o.I..v.0..zL..l....UXi..\n_.2'....:qY.`.w......I..dL............{Wh...>..a.....IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\selfupdate_continue_normal.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):404
                                                                                                                            Entropy (8bit):7.129516318048457
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:6v/7xjtSUmm5bJarDxRprObP/JnfCD/hZZJX8UA7/7:LUmm4pabP/ZfCRJXBAT7
                                                                                                                            MD5:C18550E54ED02DEE988F2DE8DD6C89B9
                                                                                                                            SHA1:28F406C9F407355D7283A69C9FE670569DEBB980
                                                                                                                            SHA-256:8A0E652F20FDC33EA57510243A09E1BE1F9B815721D698D03C50385AC0311A43
                                                                                                                            SHA-512:5849732BE1CF0FDEDB8798A50C5A72783C61AEA989DEDA6578377BF8B5EDF2CD401FDF9C85E29050846353F48374BB34F84DDA7DE750DB18E67CE3D1E6050306
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...............c....gAMA......a.....pHYs...........k.....tEXtSoftware.paint.net 4.0.134.[z....IDATHK..1..0....L....\=.&N....g/..\..x..eR.......h..$...{.'..TU...X..8.Rpp..N...zC.((.....:.8W....#..fo....X...A...Q....8.QM.........$.5.....?...c..m.-..g..wbm..._s.T.D..#.....V.&...F.fV...9.B....|..,.n&.....k.'...I...(_W.y.e.C......|?q......x.c..o..E-.....U.._...8....IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\settings_down_arrow.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):226
                                                                                                                            Entropy (8bit):6.332146371456583
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:6v/lhP8AMtCCtdo1qZg7FJemT053Wmw3jKmt403zuk9qIup:6v/7kAMtjtS1qczemTC3Wmw3jPR36WS
                                                                                                                            MD5:EF97004AEB78915DF8FC2509655D9B40
                                                                                                                            SHA1:2FDEF07F5D0623E2F48EAA18805665B9A220E939
                                                                                                                            SHA-256:DC016C4E75500448FC20A3BD80134B940C9E916817A8B224ABF3ED84A6826009
                                                                                                                            SHA-512:CB42527F0D7DBB22E31FA7F88ACEE696DE8A9206928C0C81D453E5835B2AE8B906455D1B9F18F926D23F7058FCFCCB0FFB0E2484C460ADDC13800C2F233E2963
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...............w&....gAMA......a.....pHYs...........k.....tEXtSoftware.paint.net 4.0.9l3~N...`IDAT(S.....0.......1..1.;..-......r..u.H7.t.H7.......'\.C...,..w|.;..S.........e.=...^....p.\-.x.X....IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\task_mini_graphic_hover.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 232 x 80, 8-bit/color RGBA, interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):9638
                                                                                                                            Entropy (8bit):7.97984865518991
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:q00fpcg1tIjiNXtqdkZ84SGZsvLG9MuA9rTklsVIq1QY:qjOogWfsvLG9hA9rej2n
                                                                                                                            MD5:B65E130901B97F54980D8055E9DCFF71
                                                                                                                            SHA1:E97E74874E177DCF8475B26187AF99D6708E1266
                                                                                                                            SHA-256:B8F3E5291052D9B2B898B4174D1712D89A94CE05179EBC6792CDE1F64BF28B1A
                                                                                                                            SHA-512:C52D3B9156207B826CA5466180F90568CF81FDF3B2A7DF62625660B707822242D1B22EB2D8FA1E7102D6BE2D0A81EE54C7BB5F3845CF7CE9E942E018D4D0AD57
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.......P.....d7......gAMA......a...%]IDATx..]......nF....2$Q.&1..58.....&...1.1...\ r.o..;..0........lL4..c n....c"...TT.............g....tU..{......Q....]Ck..j_....1Y....U.m....;.NfM....Bk.M.w....".........+.&..Q.>.1....M.KZ.......j.E..1H...-..kL...j....s}..V&...8Z.:..g..r....s.k...i.k,my.X..p..1.......%..C5.w._.|...[@.....].n..F.....=....H......@......5.e.<.......'..z.....f...0..E...YF.3..*.X....L...?/U.....IsV.7.L..T.+<..g..t.._C.LV.^i7.u....PTM..>.T#.A..6...L....i......S).6B.W...I.o.....r|.\..].QM..5.]..~w........{...)Z....L...dL....n..ud..l...o~.."..>._5.V.....*..hIK.I;u....{.....V....o..*kX....=..6..!......@.waeO...7...o.Lf..To...k..je.W.4.h..S+p.^ip....q..z.yu..c.j....H.D3 B3..MU9R^4k.....*./..t.EaE...*f.........,b......^I.KY.%..7).....H@.....N..E..8?+...UE7b.r..g....b...~.1+.J+...2.0*8..r.....X.$.(.C5R.....W]..[.x]..N..G.'.4....:H..h....R...{.o.....[~W5..V..xZZ.ll.9."...........m..%L.l..E...|.{..K..q..U.GFUy.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\userWidget_ico.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 40 x 56, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1796
                                                                                                                            Entropy (8bit):7.2909105950211135
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:HccNn2yIJJ3AYbHf01zb6ccKosNc/iZeFiGSS:8k2RQYz0posNCgfS
                                                                                                                            MD5:06667BC5035AB4BD576F2AA987059C93
                                                                                                                            SHA1:2D461E6A63550AF494893B3E15E4CDCE30982F26
                                                                                                                            SHA-256:9D997C1CC41716A8B51327469E916911FF9230F25792F9ACD1304B7092A4045E
                                                                                                                            SHA-512:0DB20F85F64A995BDC37B44B2435566141F8C58988DC2094732D599164DAE17C23811915A20180F1D3902E767491558911999FB44861B0FC03E75F91F963267A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...(...8......(......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:D48E426597F511E7875EEE6D51C54119" xmpMM:DocumentID="xmp.did:D48E426697F511E7875EEE6D51C54119"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D48E426397F511E7875EEE6D51C54119" stRef:documentID="xmp.did:D48E426497F511E7875EEE6D51C54119"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......tIDATx..Mh.A..g'$i.c.l6i.~!*.(b.[... TQ{.x.7....*..<.....k.......E(~P.MR.X.i>.....%.l......L6..~....7..5i.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\Arrow-Right.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 25 x 42, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1301
                                                                                                                            Entropy (8bit):6.818805785142685
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:e/1hpunQWwjx82lY2T32HEVbdasTyJ3VbGcsiGxq57M4QvkZZszWCd17a:eNitNn2V7uJ31OqRM4RsiCd1O
                                                                                                                            MD5:61A07C61B0A7F5D8856627004FE5AFD9
                                                                                                                            SHA1:3CA74E975FBF1C973FDDB40CE4DFD46001AB96A3
                                                                                                                            SHA-256:3CC78C47AC81B5C11440A0CD59DB42AAFC8426247FA891250FA3DE35EDB4B330
                                                                                                                            SHA-512:A030F0C14A74A11D0E2B4B8EAA9E628E707BCB05E8B361E7C18A8092C4D06A036F4181B515EBC83D1AB419A187A5F0D69021F3067877F51B85357F162D1FFAA5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.......*.....F..`....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:683151C6216D11E49CF79C9CE451AAB7" xmpMM:DocumentID="xmp.did:683151C7216D11E49CF79C9CE451AAB7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:683151C4216D11E49CF79C9CE451AAB7" stRef:documentID="xmp.did:683151C5216D11E49CF79C9CE451AAB7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.DZ.....IDATx...G.Q...v#".e.N.bY..?.-.K..5:..K,KD.@DD.(E...#.t-R.D........3........;...{;..cF\.#sH.. ...^.Af.'3X.H....

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\Button_Launch_Down.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 170 x 50, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2023
                                                                                                                            Entropy (8bit):7.834061182418166
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:M/692kQRqvL0hBxYK72hJuljpeznCfJFhlyFyYTipBfbO3OFaq7B:MS92krLgB6K72AgnoFaFPipBTO3C1
                                                                                                                            MD5:71AEA71E6562718453676AE12E76A216
                                                                                                                            SHA1:FD5B6EEC17E7F88C8CBAA7E0C81875BEF6F8BF4D
                                                                                                                            SHA-256:FC88BB54D0C35C746AC948FAB79FEFA948D50B120F02DD2B486495E7954397F0
                                                                                                                            SHA-512:3E95F77E81E9F5E1314A9CFDC321B4E244D4CCB9580926A5F2FC5D579E93F95B70C80E71AFD0AAF0B14457F99BD44F298E1335D54C085202F9C19F0B5473E589
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.......2......C@.....bKGD..............pHYs.................tIME......2...S....iTXtComment.....Created with GIMPd.e....KIDATx..]..E.....J"h...........z..Y..E.9z.-...!.....=H..C.BP<h..uM.Dw.}..<...~..s>^.n.`yo.kz.....US3..T.....p..)....BBc.;..|..o..[C......'...GO>vz...^{.d....$.J.T....._......\&....{..........A..C.(.F...= .....%.........^...E.prkkr....g.~..[.0...%.........$......|...../.{...../....Y........).OZ^...^8.....E.'.>..75V..J._`...s.}..B.@..{.4..q..o...lm.Hk`g'...d..WJ..} .x..vYK4..Szn.~....M...*.42......qLj..`f.Z.(.......>.40\x>.(3......~y.s.X%.......PO..*.63C..W...|..k..@.%......."......,kN)`.... .#.^c..p.......P...u..D-.....%.......;V*...D...h...TNw.|.........7O;3.....*0...%..ic.]@k......~r.\.N....e.ASl.K....8:......K..5..5...U...B.v...#.V.B2k.7...0a..@....4.q.).r....bY..|.s.RG.....\g...YA..N....-:....]......`....e+.".@......c.....`-.]g.c.F....!...pf..jW&k2cx.A....X..#7V...X.......g@)...$.h{a.....z....4.l]..<....TGA.t.FDKvz..6...%s.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\CalloutArrowRight.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 14 x 21, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1265
                                                                                                                            Entropy (8bit):6.6923871242246245
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:K1hpunQWwjx82lY2T32HEViKM2yJ3VhKSRGKVy1ay3U2yiqvOz:oitNn2VqtJ3zRZVCprqE
                                                                                                                            MD5:B516A54C270BCB33D7B4CC9964D0BFE1
                                                                                                                            SHA1:F61C2C2F0D53F14FA0918D3A8177004669C2A08A
                                                                                                                            SHA-256:37CC7014F8EB6EA19EB50F341D201B6942F7BE6A7DD124059B25C02374EAD7CF
                                                                                                                            SHA-512:1DA4B4472CC0555B676D981DD7E5AC29CF4987A70709F61FDF16517DBEFCD767EF3B4E61AF20E8B6F87DF582A18DA6FB71384513ADB102182652F06136C28A61
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.............vY.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B32C2196E1FA11E38320E0B36410DCA1" xmpMM:DocumentID="xmp.did:B32C2197E1FA11E38320E0B36410DCA1"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B32C2194E1FA11E38320E0B36410DCA1" stRef:documentID="xmp.did:B32C2195E1FA11E38320E0B36410DCA1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>/......gIDATx.b.}{%.......1..31...........@...@.L.F.8x..%!!.p......1.Q.A........N..bV f$...^.x.....(e...@.U..,..O.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\CheckBox_Checked.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2993
                                                                                                                            Entropy (8bit):7.8772256764796005
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODlV6woaD:bSDZ/I09Da01l+gmkyTt6Hk8nTX8K
                                                                                                                            MD5:8499A79EF6AE4A4141EFB1EDD8B817B4
                                                                                                                            SHA1:912DB9D9FCDBB8D9DE42C6E5D7F6589154B57733
                                                                                                                            SHA-256:C41F3C8D6E3209C94FC5E1F810F3C2F70F4865419D521BA45EBE3136C237E936
                                                                                                                            SHA-512:BAA4E39B0A473B1549740905E8CFF0FDFF2058D1A1CF5D7E5474D77A9719F638DF216C70689394072965D25459003A9768039D08B980A3F727C17B683FE263F7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\CheckBox_Checked_Hovered.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2994
                                                                                                                            Entropy (8bit):7.875356862974214
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD1NpBe:bSDZ/I09Da01l+gmkyTt6Hk8nT1NC
                                                                                                                            MD5:71F2DF5FE99973C6C439F4294D83A649
                                                                                                                            SHA1:22E22248D76017A72D35AD555E474FE3CC6873BA
                                                                                                                            SHA-256:20541025FA64693A6C0B5A239CAAC07750EA725801F04D5C7CAFC2338C23428B
                                                                                                                            SHA-512:B8C4B08B286E7A70CE3B1F0BAB67BC7E6DA9EF031244F6EC4E07A8FBA9B1D1F9C4AC7E06EF1C26F831DB9A4AA3381E9E56E0BBD7279D02798070952561B49EF0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\CheckBox_Hovered.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2863
                                                                                                                            Entropy (8bit):7.864822850364644
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODvk61z:bSDZ/I09Da01l+gmkyTt6Hk8nTHz
                                                                                                                            MD5:26CE126750DDF2E232D02BF82E55F712
                                                                                                                            SHA1:199DE9CA76A8B3A658BFD11A30A67FB4C7DD3F53
                                                                                                                            SHA-256:68F82DA5DABDA6C5A1CFD4A65891A474B47D9F6D4D85DA0462591DA6499FD0FB
                                                                                                                            SHA-512:48D9926C119E6EDC5992D9B8957D3AFF8C4B686D56AD89B033F86C3AFE223541BB8E9853B14ABD541D64BC93176C14B3D773C94CC75A94EF4CB17387A9780E1D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\EPIC_Logo_Corner.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 75 x 82, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):8388
                                                                                                                            Entropy (8bit):7.951991915149804
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:vSDS0tKg9E05Tbry8xUDmJ91Zgg08BvMR0FI0h:aJXE05e8xUDA91ZgwERWI0h
                                                                                                                            MD5:61326F602C5CC055EFBEC7959827DC54
                                                                                                                            SHA1:A65D8C517EED8A336C2401F855BF4CFEA361D093
                                                                                                                            SHA-256:6D9A0BB61108D6D0D2FB6435E65755291B66FF3B00A122DB113600A2BF2263C3
                                                                                                                            SHA-512:691AF215EB05794D7B6FCE07DCFCD60A5CA54AD6CA67F71B44AD59A4D612099A838919B595B7BBB240C1D36F6D3BEC38E054FEA69C594E524E5AFCCCEC34782C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...K...R.......).....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\HyperlinkUnderline.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 4 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):16043
                                                                                                                            Entropy (8bit):1.9951549140252085
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:wGStsMThNZkIt2sc5GFq4NqtmX+WsNXrNXpoU:wGS5kT4Nqtm65kU
                                                                                                                            MD5:AE070DE609731FA6FB8351F6B7D2FE5F
                                                                                                                            SHA1:049A20C1B7C4AC4184228912D1B10098F63D87A9
                                                                                                                            SHA-256:2DB4753369140FED5D200E95E6FE11F7933B624DAAB8A432E6D05AFC3975A14D
                                                                                                                            SHA-512:ACCC717B505F7807028313642E4E09501F73E95F3FE7ABA114C279692DE6B80B1CC947155D525E99DAF9EA7555AB1866837E0C55ABC6ADBFBE93F9E821303D65
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...............~....sRGB.........pHYs.................tIME.....$.X:}b....tEXtFile Name.Untitled-2).....=.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.352624, 2008/07/30-18:12:18 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/">. <xmp:CreatorTool>Adobe Photoshop CS4 Windows</xmp:CreatorTool>. <xmp:MetadataDate>2014-02-06T15:36:11-05:00</xmp:MetadataDate>. <xmp:ModifyDate>2014-02-06T15:36:11-05:00</xmp:ModifyDate>. <xmp:CreateDate>2014-02-06T15:36:11-05:00</xmp:CreateDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#">. <xmpMM:InstanceID>xmp.iid:99870BDC5D8FE311A

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\LoginPage\LoginThrobberChunk.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):16078
                                                                                                                            Entropy (8bit):2.0132983735678143
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:oS7QZkIt2sc5GPqFtmD+WsNXrNXpvu1Fz:oSYkVFtm25ruD
                                                                                                                            MD5:C4BD0AAB6788955E3F24F3DBBDA38221
                                                                                                                            SHA1:ACEB88345153DFC1A3E90DF261CDB42DEB3ADB37
                                                                                                                            SHA-256:B9BCCB151679EECD9E797F8E948580BF915A5365CE1EE1669802A3C18BAA37D5
                                                                                                                            SHA-512:AA08ABCBFF38119862D73A6FD4E7A8ACB7B6F293ABDF25A4EF32D31BC01F9415C11F4210CFF3460A3ACAF9B84F829483FA0120E7455A404F514135671D4EE90A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................H....sRGB.........pHYs.................tIME.......w-.T....tEXtFile Name.Untitled-1......=.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.352624, 2008/07/30-18:12:18 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/">. <xmp:CreatorTool>Adobe Photoshop CS4 Windows</xmp:CreatorTool>. <xmp:MetadataDate>2014-02-07T13:24:05-05:00</xmp:MetadataDate>. <xmp:ModifyDate>2014-02-07T13:24:05-05:00</xmp:ModifyDate>. <xmp:CreateDate>2014-02-07T13:24:05-05:00</xmp:CreateDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#">. <xmpMM:InstanceID>xmp.iid:1E82D5062590E311A

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\LoginPage\WarningMessage.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1553
                                                                                                                            Entropy (8bit):7.047413266797472
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:t1he91Wwh82lYSKwVo4RjVx2R4T3cyJ3VKRVPGPesT+quUcBww3DDhbxXidO0s2T:TqQvnL8tNrJ3QfPW7ydl3xT0N
                                                                                                                            MD5:C07B05FB66B8B1145CEB5AC5588B61A5
                                                                                                                            SHA1:C0D875E10C20E9A0ACEAB4F012FBC58A7F01BA88
                                                                                                                            SHA-256:8F0FDB24AAECA8B9C174A7DC4240E13D675B85F91BB2FD3FCEC98650AF304B5B
                                                                                                                            SHA-512:E187885AD1B817E2F184BA6D8218DD1BA81F69D7F28399BD21092363768056BFBAC3EC31715F9317F9E5EEE38D9A634D72C9F4D76CC2D5EDCE9CC8AE7D1C3778
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:50864549699EE311B092B6E4A26229C8" xmpMM:DocumentID="xmp.did:58D53F481AA911E69AB8D7F29C951D96" xmpMM:InstanceID="xmp.iid:58D53F471AA911E69AB8D7F29C951D96" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:50864549699EE311B092B6E4A26229C8" stRef:documentID="xmp.did:50864549699EE311B092B6E4A26229C8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......CIDATx...+DQ......#....`!.?"...Y..+.....B

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\NotificationBadge_Middle.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 44 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):309
                                                                                                                            Entropy (8bit):6.054343807264034
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:6v/lhPgXOudn+Hgvd+qgv5m9p+qgv5m9p+qgv5m9p+qgv5m9p+qgv5m9p+fdZdp:6v/7ADWgcv5KAv5KAv5KAv5KAv5K6dZz
                                                                                                                            MD5:E03F1F2D51299D73D9502ADDE9BD807A
                                                                                                                            SHA1:86671DB9619755E2D54165DAF1A7929354A73AF9
                                                                                                                            SHA-256:32D88811543A4EBEB4ACDACCF2349C4EC68993A803E7AA4925B59FFAF2166E2D
                                                                                                                            SHA-512:937EAFB8E21AF9FF662510449A71182397931433C331668744D8B4C589E8705042FAA2E49C1273F05CC1775C17F5A91BF474A9855CFDCF63789B2E2694A4C9FF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...,...`.....f.......gAMA......a.....IDATx...1..0..Q......c.0v.|.....}...A.~.v../.p.........L. z&..b0a..N.....g.:)........L. z&..b0a..N.....g.:)........L. z&..b0a..N.....g.:)........L. z&..b0a..N.....g.:)........L. z&..b0a..N.....g.:)........L. z&..bp...J..9.`......IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\NotificationBadge_Right.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 48 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1322
                                                                                                                            Entropy (8bit):7.704908908918472
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:bGYPEgtf9Z+rRqi6cSAYEp5+1hIvUR80zXYbwe21rWymNgpg:HcgtVUFqJkp5+1VFD1rWPNig
                                                                                                                            MD5:6BEDC4F5BCEF662B66747C1D6136BECB
                                                                                                                            SHA1:3ED98FAB84B91EEA4DEC0360B330E4153DB0BE02
                                                                                                                            SHA-256:B983DE30371551C28ADC7590B74DF194DEF2DC0A0AB6FFE0F114AEA0837CD191
                                                                                                                            SHA-512:932802DFCA0D7EA4121398ACE2343DB3DD1D07A5EA52647B60160DD56CD45F7DBF227654FC79F0EBB8EAED86D5AD0F5B20F9618F57A014CF11A572BA40992A95
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...0...`.....[..p....gAMA......a.....IDATx..M..G...U...W........DDe=$AH..x0`4...?@.'%...@P.&.@.......!$...D=(&..8...zZ..5d7;U/..Zk9.;.3............z]=......B5....D*.......Z.uM.P.........A.f.@......O.aX..9...7.\7.g.h.B@.,uAi}<.]x..?.k<.[.[.....I.........;@s...o..6./.,s.#.E....i..+..Q.'..r..>....A....QjDG.n....N..._........fP...~.X....H..^..yt....;%.}O...B..............k.N(".5w.:.q.R.......XTk.....=.....@.FT.....W.m..4..M.}..~..E...Q*@..T..=.*D...!h.e...NA.8KXk~....H .O@..<!6(.....N..z....!h......HRo..&.3X.e..,.7.E.t..4.......\^.4..p.F..7...<.?O.p.k<.)J....E...s..'b.X8(.?..",..4r]fn...u.......O.~~z......:Py.....|.y...V.|Q.H....C...B..u.^39.I,@"..-...71~q!C.s!.M...ck...pk....d............v..oqUd..F.~......0..V6.(..@~$..._....@4..!...-....Mv...-...]&.@..8.O..89Q4...j..8-T4....GJN...@.?...r.(..G1b.fR.....SRm..X.p.K>..B.t.F...8.3...p..../..I..k~*E.P...s.<...xnB...1..9.<..o}......i.)D....l....a..6'.@.1'G.........@.._G.......4.....Q'6.......p

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\NotificationBadge_Round.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2279
                                                                                                                            Entropy (8bit):7.888039640404209
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:xnzpj5FYo2aCWm67YtX20M40kwRXcW3fqEVPGPZ6CyY5AWRYtEIaKzRoISdQl:VzpgoGWm67YV2nZ9+P8Cx5AWIaKzaI3
                                                                                                                            MD5:19B119BED336CFC8156E943FCB03EF1E
                                                                                                                            SHA1:2B17A2A00C30BA43E4C036A0C9EBB70703F1E754
                                                                                                                            SHA-256:1AAC5A73AE07C0D40085FFA086E52EDC6DD6DD25D8136E8F6B290AE70AC4CBD8
                                                                                                                            SHA-512:7ACB16BCA8682A76647D99DE8AA3AB92D8705A46D1B29F7E9476B90F219A3E58EABF29397EAB230E1E942B860CCADDC997B6E7C5E2DBD10E080556B2D5309C65
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...`...`......w8....gAMA......a.....IDATx..O..D..g&[Z.n..9.U. ....R..,.`.*.ZDDEA...-...^.$xi."R.E.X..B..Z.T.........V.....m^6._2I.6.x$y...o>..$3..b@7.o...>.....zLh1...Sj1"$~..k1......K-.....r.SjR.2:)'.N.bV.(.k+..Q.....D...Z..........;..<...IY.|.B......Z..G...E...;{#.{i..'.2...J...,;,w^......@kd....._.(...Xb3C..%...Z.U..T.=&%n.............!..-......(.8.=..w.C...~..3\....._..$E..w.=.t-,*J..-.^.m..m.\..kC..........(.p.).{].f...lKR..@.FV..?...x..s....O.<.p@yK'dm.mQ...]......Ya[.2...KJ.W...k.zX3..x........y.....zI....&.k?.....tm..~p.....6...4.8..;dm....f6.~{.@.~.*gUVe.R|...*=.E.;s&..*Kd.r....U.Of..;.da.............gQ`!.e..,..#U.D.R..-..fZh.x...,...=...n.}..T;..X.-.*.......C.w../.4.\....v:.E.|....~.....f.\?....U.3.#.xC.]..a>d....w.......W....?._...^.u.....Y......._._....$F...n.:......M.X.T/.b.r;..K.....[.U._);......k..i.-..).....z..`..M.>.$..~Fl~.jk.^..k._s.K0M.h...pq./..I.,.?.$.$=...w??.']..KO..JH(.....#hx....8..I.d.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\NotificationBadge_RoundInfo.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2310
                                                                                                                            Entropy (8bit):7.874330739799925
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:sem5iGBcCQYZIOpAGX5kUHf6yAhyfIOFmW0g9q:oM4coZIK5PHfso7OZ
                                                                                                                            MD5:01157878409C7BFB56F939526F193E55
                                                                                                                            SHA1:D3BAFA45C7BAA27E085DBFFB6C5F68A3F781261E
                                                                                                                            SHA-256:F26CDED0E564ACA99C3AAB16E0399326E75F8094944A1572349889CAED6CFED4
                                                                                                                            SHA-512:D53E9853A09BEE08468418E7BC1172AAC4341A015F251A56871694348A761D0151653769B34E3FA8DB10ABEB07D848E6CBD61208300291D17190A3CFEB6F0490
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...`...`......w8....gAMA......a.....IDATx..O..D..g&[..n.....a....z..`..ET...H....z.E.}V..K=...J...E.<.P...).+,..A=...[qK7...y/K^..$/o...L`I.&3..|~3.I2..I1...zR....`Z.=-...R.!.......k1...q...Z...Z.YO.Yq...qqn..*.E).X.B..L..M ..`....-l.........q!.N......8.+....{.?.u....P.7...7.~..>Z.)..!o|....J...6.-..Z...=..z...)........b^hyLy.K.{.')Q.J.J3..f...qt..wQ..J,cfQ.q^{.C..-...G......p....}Y.`'j....ZZR...Z....[.(....@7...|.......(.p.).{C6.~..mGV..@7&W....0.x.....Q...@y...n.!.s.m...G...Dp.......2?....zU....5..O./..>.....l*8lya.._.Y.C......Y1.n........>lC...C..Z.M6...T....[.!..?.zPeF)=FJ....,?.qf... .1.y.....>....`0....X..!..Pdb..F9-.N.d....nA.(u...1.B...D.`Q/....K....m.5_.ei...<@..C.xh...r.e.v..{~mo;Ip.1_C....9..8....g..$)Q.sft..o.:D....!..|.?.z..a.f.W.....?g?..CV.ji....0K...SoA|.....y.r..'H....T...u..wG....x.fK......s2L*w...J.....f....0T_.z-.;..........F..D...Ww5.?#..d....u....m.a.............G.3b.p.rL.d.M.%.`....n....'`&%ti.K...#.x

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\NotificationBadge_RoundWarning.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2316
                                                                                                                            Entropy (8bit):7.872496758109341
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:SK+T7zVjMzF+5xM203a9PGnwH+6lbMKFCdUVL:X+PzVAzF+5xM73RjxeyUVL
                                                                                                                            MD5:56F6845916419B9EA942D801A7254079
                                                                                                                            SHA1:F70A746CC36C8942B8522AF21FD9678C46214627
                                                                                                                            SHA-256:2BBC4703A2F7F851AA110BF6371200E6FBFF0E06543DBC03FC9E0CAB0C222F87
                                                                                                                            SHA-512:035041A5F7A98CEDCD65D5028F8E92E23EA45DFC8D042F8A9C987EC79AE76D5F8944B9627860EC78CD8EB25A9C3E2FC95B41E11ABBCF5028227493585B16D751
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...`...`......w8....gAMA......a.....IDATx..O..D..g&[Z....U. .....zPY..."*.ZD....I=.".>+H. x.U.H-.-..B..Z.T.......n.?[.....{..e...^&.{/.x$y...7._&3If~?).t.....f'. ..BO.-&..7K-../\S.-......k..o..BN{JM..&....A,....tc.*!f..@o....s...haA&..8..WJ..b.l.y.B...R.~...n.../o.A.,......7.^.C.}.SB...UG.K...o3m....E.k....;..j-V.,P.yI)..'?.{.....B.Ki..o.._.m.~..Jxg.e.,.0.kO.....|......7......v.j.-.....ZqA...k..E..P....}....+~}i.,...s..^....,f.U!...5...~t>...Bd.....(.".R..;ecn.(.p.n.@..q.Ym[.*....J...^.+.zX3..p.......y.....zI....;.K?^.......[....T.{m(5.yHq.S.....yu.m...M.\....5y.....S.Qzl.|..<z.<'........|2c.M.. ......{.]....<...,;..E.....D.R...{.._h..../X.3c{......l.s../.n...8@^.C.#xh...r.d.V..{~mo;ip.0...ys/.sf.....W..IS...L.H-.......C....~....+0.Z.L...8.nm...P.....Y.t8....w;....W)I..A...w.k*5.[.=.....(U[.V./.l)T.|..|D.i.N5._).6Ro5.`.>.......s.h.~L.....#.....a..:.........H..........L....D........3b.p..M.d................A...`..8t.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\OutlinedWhiteBox_OpenTop.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 8 x 8, 8-bit/color RGB, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):937
                                                                                                                            Entropy (8bit):5.8104438047679
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:Hh1hpunQWwjx82lY2T32HEVDTutTAyJ3VgcTTTTRGCJ:vitNn2V5ODJ3aMzRr
                                                                                                                            MD5:607D9123BB070B183B2B1BDB47AC2AD3
                                                                                                                            SHA1:31919F6F61DEECC4C030D95F75F70ED0519660AB
                                                                                                                            SHA-256:23B16838B590D437FACA83378E751CB9F06389105F8AEA291C28818901DD367A
                                                                                                                            SHA-512:F33C8E2095BFF47334B9738E76438AA2B65682865938F5CC420CC017728A436703E96B4B95E5A5FE736FCC68137A724398AD290A04A8F74063141CC0C2E10FDD
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.............Km).....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:283C04ADE21B11E391C2B262ECC9B134" xmpMM:DocumentID="xmp.did:283C04AEE21B11E391C2B262ECC9B134"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:283C04ABE21B11E391C2B262ECC9B134" stRef:documentID="xmp.did:283C04ACE21B11E391C2B262ECC9B134"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.z......IDATx.bd``...?.*`dddb...T.'..0.O...2.......IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\PatchButtonCancel.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15727
                                                                                                                            Entropy (8bit):1.9617442510888667
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:+2SylZkIt+WsNXrNXpd2sc5GcqvtmXgep:XSyLkd5vvtmwep
                                                                                                                            MD5:994A9E0DE7C47B99AFB9FCCC5778C274
                                                                                                                            SHA1:041F2B6FC406534E267A04B2E9E3EC6BF104F994
                                                                                                                            SHA-256:6FD368FF0D52E2E810801E889C600A085A4FA3CEF27DE663973C2DFDA92BC7FA
                                                                                                                            SHA-512:D01FD92BE927109902EB37286CE3212BB2DA852ACFC47EDC708342E492019EEB343DC810E29542619D7A3FB98030A2065FF63231BCDD7FB1778C6A1B6F56AD75
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.............Vu\.....sRGB.........pHYs.................tIME.......n1.....tEXtFile Name.PatchButtonCancel.png._[...<.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.352624, 2008/07/30-18:12:18 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/">. <xmp:CreatorTool>Adobe Photoshop CS4 Windows</xmp:CreatorTool>. <xmp:CreateDate>2014-03-11T17:34:55-04:00</xmp:CreateDate>. <xmp:ModifyDate>2014-03-13T17:03:06-04:00</xmp:ModifyDate>. <xmp:MetadataDate>2014-03-13T17:03:06-04:00</xmp:MetadataDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. <rdf:Description rdf:about="". xml

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\ScrollArrowLeft.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 9 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2939
                                                                                                                            Entropy (8bit):7.8751350252382
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:1/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODGp:1SDZ/I09Da01l+gmkyTt6Hk8nTGp
                                                                                                                            MD5:FBD05AC80ACDB9D854E7D30E9EFE74C4
                                                                                                                            SHA1:1A2A6B66B193E93FAF49D8DA1328350D9D326A14
                                                                                                                            SHA-256:5F1542E96AD465E0C8C2586AB7449C715DA47EFEEB7BF3C31649433197E8982E
                                                                                                                            SHA-512:1762732D863AAB5A1A1B19A6873947ED2464500FF35EE8F44C571E013D80DA3FEA3DDE2E80D4B90B27EBBB2E124D9535DF371D0825F9E359119AB5ED8339460B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.............B.'.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\ScrollArrowRight_OVER.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 9 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2926
                                                                                                                            Entropy (8bit):7.90648535434529
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:EldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBf/6b3hvIypSB:EXHt+JcNgOSiS4XsAYNpf2ESNwSFE
                                                                                                                            MD5:FE1B0FA672066528158E0F0B34D73D45
                                                                                                                            SHA1:AB6A8C25A0449F5C4E9CB3EE302B6C50F0DFD18A
                                                                                                                            SHA-256:9FE680DF2A49D71A72609B6DD97EBF0329149B8720C9BDF45C5A92468075247C
                                                                                                                            SHA-512:2A9E68F270CF146BF08EF20F255A6AF5745393D11ADA0256371764C32C131110D00AE08211A32AAB2D697EA82509C6B7EADAEA7B89799FB67D111D912381C9E6
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.............B.'....9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u*@~..(.. ...]..o..0 ~y.*..s..7.g...%...9.%(....3........H.*...@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f..*...z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.....>L...f.3...b..X}..........*.Q.Y..v...G...p.(..........

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\ScrollBoxShadowBottom.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 64 x 8, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3003
                                                                                                                            Entropy (8bit):7.895225254453698
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:1ldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OB64FYG:1XHt+JcNgOSiS4XsAYNpf2ESN52YG
                                                                                                                            MD5:9A8B7720B46CC08ACE9002717CA32E9B
                                                                                                                            SHA1:370BAF8D71C135B1BF19B67EA72F983469204177
                                                                                                                            SHA-256:10E7B34C5A10133534ECF3CF79C37090F9ACA5FE256100F9C4DC9EC94F137E4E
                                                                                                                            SHA-512:0D3306D0AF7F4A5FCDBAB0ABAD0B2D689C5D020B5EC9E83212725934A8CCB43FDF1DBDCCE118152736699CD17D90EAB994DE009878E34D72912DAC13FBFDFDF4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...@.........Ib......gAMA....|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u*@~..(.. ...]..o..0 ~y.*..s..7.g...%...9.%(....3........H.*...@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f..*...z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\SearchBox_Hovered.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3379
                                                                                                                            Entropy (8bit):7.900810931888687
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:lldHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OB78jpcmzBBk:lXHt+JcNgOSiS4XsAYNpf2ESNg8jpzz4
                                                                                                                            MD5:3FE8B20F355CA9CCC770C228B94081F1
                                                                                                                            SHA1:31C1AD0D7E8351940FB766019D2C90D17A8F832E
                                                                                                                            SHA-256:C7CA4B6FFC563D91481509D5F504BCA07CB2F534C470019CD6BD33B4EB621778
                                                                                                                            SHA-512:F3D3F57AC993BCD361109F4DB0DD933F6473F055E40C444AC3F76061F4F02C3883E6AB9D889C57912408B6D57D94F47F4832F8F86C45F397576A96438E018323
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR... ... .....szz.....gAMA....|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u*@~..(.. ...]..o..0 ~y.*..s..7.g...%...9.%(....3........H.*...@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f..*...z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\SearchBox_SearchGlass.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):500
                                                                                                                            Entropy (8bit):7.31879354458995
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:6v/78jtS1qcjoe+nPhXSHeokvjllumaWZdcctAl5JnfVf/weB:M1VceGhCHmRlRa4Al7fVHweB
                                                                                                                            MD5:E395AB024BD6659DD1836A7B3680EC84
                                                                                                                            SHA1:2FAE4B7F06993AE051CA5326DB87BC2C2D78621E
                                                                                                                            SHA-256:03A1D7BB9899BEF75EEDA31216F00AF96D840EA65E49E2A6D0C1A70133685E9A
                                                                                                                            SHA-512:F065F414A3CDAFDC7E031000C3B95556B018EF9DBBA8059CB7AB2FE93B5F2B1628BD4A04495012D8F4D40D620E21E0D993CDEB888CBF39556BA52D785E78AC31
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....gAMA......a.....pHYs...........k.....tEXtSoftware.paint.net 4.0.4.......rIDAT8O.R].AQ.=....H>..$.../$..<8......99w.{..5..5...3c.0`.6b...&....X,b>.c...u]..cd2...E..f.......b..j....q.Z....PS.T.x<.0.J......n.*\(...O..l6..v.D".....b2....'.z=...b4...a....,.....Az...8..H$...9+..k..Az`...&......z.^.K.L.v.x>.h4..G.a.x.E8{N...N..=..f..}.....F1..q>...b...<........j...L&Q......d...1.~B...Pd.\"...............&..N..c..j..C..X*..e.....=]s......IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\SearchBox_X.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):344
                                                                                                                            Entropy (8bit):6.9415609943303895
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6:6v/lhPUC8qZg7jUUjtUogkr6TwrZok4aKZyNE+bF7q34fgOhSt3/p:6v/785qcjU6tUogvwrP4bZUzbtq3/t3R
                                                                                                                            MD5:3C92EB6C3D0C1C7E69DE13A360EC8F51
                                                                                                                            SHA1:4860E6E417042E488C2568BBC266F393C6A514C5
                                                                                                                            SHA-256:C1407F66383A475F2D2EA6DE60E8F450FF9D3D8137FC7BC3050198685D619C76
                                                                                                                            SHA-512:C0CD061175C77A5F9194405C934E5EC5D3DA021C5ED74121720DC098C3023B0AE8DCBC6E94ECFE2967650471EA0F7C39BA07219E8A525F7775545032F9E0F341
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....gAMA......a.....pHYs.........8.S$....tEXtSoftware.paint.net 4.0.4........IDAT8O..=.D@...d...%. "r...'P....|._W.bk7..u{?c..yH..G..X..XEQ(M...........,5M...Q........S..u....<..JQ......#.zV.<.0..M...k7....O.<.p.$I.q.-.......u8:>.s.p.....m......F@.e...F...:..=.n.k....._.>..'.....=.B..o..\`....IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\SmallRoundedToggleRight_Outlined.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1131
                                                                                                                            Entropy (8bit):6.494156472593123
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:K1hpunQWwjx82lY2T32HEVzz1oqW/iyJ3VzzJRq4PGQkcr1fTfMN:oitNn2VFzbyJJ3Fze+df4
                                                                                                                            MD5:2F547E30E5CFDA6AD08E987324D4CD32
                                                                                                                            SHA1:E12197FF0BDBD4E6801296E3AE1D2C26E80CBF27
                                                                                                                            SHA-256:FED07830EA14A3A936077CE362F28DDC08FE6B229CE95DCCFB5D2F1DF8ED455E
                                                                                                                            SHA-512:C10B4F8955BD8C7D86E6A06846E6CE365C2302B8B94017132752D1E63F786F009D0AA742D15B56141FA63AF035639EC221D49AB355F6E6BD984F961784D86D77
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:0DE7F551E21311E3BD759F77B7E8F236" xmpMM:DocumentID="xmp.did:0DE7F552E21311E3BD759F77B7E8F236"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0DE7F54FE21311E3BD759F77B7E8F236" stRef:documentID="xmp.did:0DE7F550E21311E3BD759F77B7E8F236"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..?..P..om.....Oh.........."...1...|.ii=.H............9W.@...#.2Y....B.].;..Lk..x.B...x..@.ZC..b..\.'

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\Throbber_Piece.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2928
                                                                                                                            Entropy (8bit):7.876985727119462
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODjhpfN:bSDZ/I09Da01l+gmkyTt6Hk8nTj7fN
                                                                                                                            MD5:78939BC95532D22DDA513D6CB7C6415F
                                                                                                                            SHA1:447CF0A5795F615DBEAA36FFC5F5C69D47247CDE
                                                                                                                            SHA-256:F0F1F9AA994449E519FF3AD9D36ED73600CF2A7281E4E1FB6C32D172FCE8E096
                                                                                                                            SHA-512:F7E086AD2FD29CBC1EB10131E76B0713A420A66ED3E9FFEB8A04714ACAF278F6AFCC2F1E9CC8B42B20EE2AD8FDF0A879C6FB6BA46DCB26C9B29EDEE9658615F1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\UE4Logo.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1101
                                                                                                                            Entropy (8bit):7.717092617414279
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:TiV6+Y4Yw34ufd161Fyvuu48aNwEYiZGNxYmOH3xU/mBbQa1uoVuJ7:e6n4YCNdVvuuW7YyIxk3C/wVM
                                                                                                                            MD5:3BCAC9EAB5FAC148F87450892A1195FA
                                                                                                                            SHA1:7C5E593884A93392AF2357DB85A20AD2CFC30F58
                                                                                                                            SHA-256:1605DFDE1844F4506ED1246C5C233590DC798D01F72DFC8726690643224CBF98
                                                                                                                            SHA-512:00D973A895A293A9727111C6A5A0721D4959188331113DC390172562B8317256C47B3809C9B58ADB205B8D07BD8FB8CC95892F8476DABD40CBA8AD0A12C25FF3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR...(...(........m....pHYs...........~.....IDATX...J#A..kZ.GGXX.t.^.."...0o`...{.7....y...:{...}......ftY....?vK;.....I.tW}]]=]]:.s*"...ADU"*..u..M|^.Q..:...Bv..:...Q.1.%...Z.v.......{.....!.......`.nw.1v.E.W"js.Ck...jD..{..........G.S0.c...........@...y^.1...:...1.......O..%.:..6.."V.......U..6D\..b..y.F..........L.k.J..~...PQ.-.m#.x.q.e....!.T*|ccc"@................l~~>V.8...NNN...T.`....p.....J....i.lBA...N...~...S#...p...<.....0.^..kfy/.94....a.wwwc..../6U.....o.X.M.........,". y.......g.................].\NM&..6...['.....7.[2.1.X..8..@.Z.>..w:..<...>.F..{...`.....H.1......7....`r.%F.i....?.(U.S...%i.ZS.#..eul4....J...vG.J."....p8|...^..}&.....yM.L._.t".........8...gxUmmm..[0.2.y..{.XK.cH$p<!{.s..~.).....d...........:.m..!`.w..T.w.S"...=..K'`...j2........\ i.....,i)...tV.|.f..O..1..g.....c.2q.T*.X..L.TA..}m.U......}......'.H..I.<...^.j.....S..UT`.6.wbS..I...$l..h.-.50+..|Q.n.F..[.q...[.1.tA....e.........q;.(.B.X.#.*k&...k..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\WhiteBox_Half.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 2 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):931
                                                                                                                            Entropy (8bit):5.824112886006059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:TB/1hpunQWwjx82lY2T32HEV6rRdZIdyJ3V65FYZ+SG/9:/itNn2Vcr1rJ3c5qXE
                                                                                                                            MD5:38722D284405D6B7E4AA94F69974F3B5
                                                                                                                            SHA1:89F7551A9EE19E9B363C0291174A3A773434451F
                                                                                                                            SHA-256:68B7DD06F00B01E0EFB95A40E115364382E3880C45A2136A54BD16C0D5DBAECE
                                                                                                                            SHA-512:F551DFF577812A5DD84740605B70F7D774FF2BC05DECB71C62B3652DC8FF9823D717F3B4064AA0889E21F02EC1F3BB823F0F164F5DFA1A44795C164104B769C7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.............r..$....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:808F21B3E10111E3858B98257A9456C1" xmpMM:DocumentID="xmp.did:808F21B4E10111E3858B98257A9456C1"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:808F21B1E10111E3858B98257A9456C1" stRef:documentID="xmp.did:808F21B2E10111E3858B98257A9456C1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.b...?...000|.b.....X...........IEND.B`.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\info-30x30.png

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3365
                                                                                                                            Entropy (8bit):7.909660916770975
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:NXHt+JcNgOSiS4XsAYNpf2ESNEwuOVgi7+F+pFDA:RoONgOLPXsAYnibgi7wyA
                                                                                                                            MD5:E467C881C1075F4AA958D3D98C417F08
                                                                                                                            SHA1:BC562BBB8EF2A8F5378B07860F6CC937695E00E9
                                                                                                                            SHA-256:225485D29794CC53C206FE475809921AA7B36744E8A63CD64678B8A42424915D
                                                                                                                            SHA-512:BDDA2A6AE90E1116336D54165229D59110EA5E2C7187C94480ED71E1253D6909D3503120F23D36883D637848A6852897E3D946121D8695532103975B06B40019
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.PNG........IHDR.............;0......gAMA....|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u*@~..(.. ...]..o..0 ~y.*..s..7.g...%...9.%(....3........H.*...@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f..*...z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\SysFiles\AlertMessagesV2.json

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (469), with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):202962
                                                                                                                            Entropy (8bit):5.692836311112738
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:CiP0VAPqExoHgmUqteN0Jx+MRTCSRlr1istBBJaKs:GG/keNimCMsPBcKs
                                                                                                                            MD5:7DA75C1E61B690E74A85613AF05EFAF8
                                                                                                                            SHA1:1F029CACC3796C3E1011FD61E1E57209E49C1974
                                                                                                                            SHA-256:3697F143C7354F92311121579C7E7D0118FF8953AFE607E1E5C1E7687291D679
                                                                                                                            SHA-512:21221B5D770923E1E59A348B2CA6D2B9E6D38F54A58B2657B8CB9CE89563903CB4019B65F2478D468B5A53FDA47DA7DC7802273A62C59EFCD1D6C964893B84DA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:.{.. "Messages" : [.. {.. "Codes" : [.. "SU-1001".. ],.. "Title" : "Self Update Failed",.. "Title_translate" : "true",.. "Descriptions" : "Failed to create an installer.",.. "Descriptions_translate" : "true",.. "Title_zh-CN" : "......",.. "Descriptions_zh-CN" : ".........",.. "Title_ja" : "..........",.. "Descriptions_ja" : ".................",.. "Title_fr" : ".chec de la mise . jour automatique",.. "Descriptions_fr" : ".chec de cr.ation du programme d'installation.",.. "Title_de" : "Selbstaktualisierung fehlgeschlagen",.. "Descriptions_de" : "Installer konnte nicht erstellt werden.",.. "Title_ko" : ".. .... ..",.. "Descriptions_ko" : ".... ... .......",.. "Title_it" : "Auto-aggiornamento non riuscito",..

                                                                                                                            C:\Program Files (x86)\Epic Games\Launcher\Portal\SysFiles\NamedBaseUrls.json

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:JSON data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2346
                                                                                                                            Entropy (8bit):4.711690635503979
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:aliKHMu4oGzcm2HxQS7IOrGPzmtYWELxQqoCyhFmA:aDMuMGXaxarmA
                                                                                                                            MD5:42A7FB43C1A33B4B1CCF1C665647C77B
                                                                                                                            SHA1:8ADDAE3C4E238F23A60B2013E4655A384211BDCE
                                                                                                                            SHA-256:74F7FDDB5FB3EA3CE2856140A690C25AED3FEBD2256ABFDB261ABE2B87025E7E
                                                                                                                            SHA-512:76136714AA040196A782FBAED92D4708BF84FF4203D0080A384BE4604370567193A788E6596A09B136EF4E1E3F9F16FAE7CAE4C87BA713F720F3FEAA4E2C91A2
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:{..."BaseUrls": [....{....."Name": "epicgamesnext",....."BaseUrl": "https://launcher.store.epicgames.com"....},....{....."Name": "epicgames",....."BaseUrl": "https://epicgames.com"....},....{....."Name": "storeweb.epicgames",....."BaseUrl": "https://store.epicgames.com"....},....{....."Name": "epicgames.epicgames",....."BaseUrl": "https://epicgames.com"....},....{....."Name": "launcher.epicgames",....."BaseUrl": "https://ue-launcher-website-prod.ol.epicgames.com"....},....{....."Name": "accounts.epicgames",....."BaseUrl": "https://accounts.epicgames.com"....},....{....."Name": "accounts.launcher.epicgames",....."BaseUrl": "https://accounts.launcher-website-prod07.ol.epicgames.com"....},....{....."Name": "forums.unrealengine",....."BaseUrl": "https://forums.unrealengine.com"....},....{....."Name": "unrealengine",....."BaseUrl": "https://www.unrealengine.com"....},....{....."Name": "publish.unrealengine",....."BaseUrl": "https://publish.unrealengine.com"....},....{....."Name": "help.epic

                                                                                                                            C:\ProgramData\Epic\EpicGamesLauncher\Data\EMS\EpicGamesLauncher\NamedLinksV2.json

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:JSON data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):71868
                                                                                                                            Entropy (8bit):5.325421920474391
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:+ibcLjEmiqrXUeontgigNm7ReMBSvfE3OuEsl:+ibrMkCigNaS0
                                                                                                                            MD5:7B3736FBFD3E14C718F65BB0E9AE8E2D
                                                                                                                            SHA1:F82C46D79BF853FFEFAA4E122DDB63D3AB974E31
                                                                                                                            SHA-256:E6185D198759C2BF85AE7A579C13FFDEBED082C1E48F2119F376D85031B90CA4
                                                                                                                            SHA-512:57B2372D3DC808ED38A4261179F1BBA2273EFFCA0F6C4E3FA66581ABDBEDE1FA7AE44003688ABB9CC7F17C1FBB2FC10F0AD6A002A610F092168D348A9C1F6FC4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:{.. "Links" : [.. {.. "Name" : "Launcher_No_Longer_Supporting_MacOS_10_9",.. "URL" : "{epicgames.epicgames}/help/en-US/epic-games-store-c5719341124379/launcher-support-c5719357217435/epic-games-launcher-no-longer-supports-macos-10-9-or-10-10-a7535371800475".. },.. {.. "Name" : "Launcher_No_Longer_Supporting_MacOS_10_10",.. "URL" : "{epicgames.epicgames}/help/en-US/epic-games-store-c5719341124379/launcher-support-c5719357217435/epic-games-launcher-no-longer-supports-macos-10-9-or-10-10-a7535371800475".. },.. {.. "Name" : "Launcher_No_Longer_Supporting_Older_MacOS",.. "URL" : "{epicgames.epicgames}/help/en-US/epic-games-store-c5719341124379/launcher-support-c5719357217435/epic-games-launcher-no-longer-supports-macos-10-9-or-10-10-a7535371800475".. },.. {.. "Name" : "Launcher_No_Longer_Supported_Without_EOS",.. "URL" : "{epicgames.epicgames}/help/epic-games-store-c73/epic-online-services-a

                                                                                                                            C:\ProgramData\Epic\EpicGamesLauncher\Data\EMS\EpicGamesLauncher\PortalRegions.ini

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1600
                                                                                                                            Entropy (8bit):5.105123752764663
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:PeA9ahcEvSLkzmZ4dx1hyBTWz9LSNWuv+78hPPR9c:PeA9aSEv2gmmddSWJ2WaK8h3w
                                                                                                                            MD5:D06139530BCC99514B3DF585C587D57F
                                                                                                                            SHA1:5F3797F1D7EAED98EB5A4A552A67F98F23F38A99
                                                                                                                            SHA-256:5F291BF36E8EBE726ED442863969717668DA34B61FFFDE1F8FC604CD85BD8308
                                                                                                                            SHA-512:C0938EA8B3A760225501EF9EA875C65CFA1CD75D8BA14E2CE0DD8A9B788B1E914EC5B539934842F99D84AFB6AEAC15F378CA1BAD25E96676CD51473B662294CA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:;========== PORTAL - CODEREDEMPTION SERVICE ==========..[Portal.OnlineSubsystemMcp.CodeRedemptionServiceMcp Prod]..Domain=coderedemption-public-service-prod.ol.epicgames.com....;========== PORTAL - FULFILLMENT SERVICE ==========..[Portal.OnlineSubsystemMcp.OnlineFulfillmentServiceMcp Prod]..Domain=fulfillment-public-service-prod06.ol.epicgames.com....;========== PORTAL - DATA STORAGE SERVICE ==========..[Portal.OnlineSubsystemMcp.OnlineDataStorageServiceMcp Prod]..Domain=datastorage-public-service-liveegs.live.use1a.on.epicgames.com....;========== PORTAL - LIBRARY SERVICE ==========..[Portal.OnlineSubsystemMcp.OnlineLibraryServiceMcp Prod]..Domain=library-service.live.use1a.on.epicgames.com....;========== PORTAL - REGION ORIGIN SETTINGS ==========..[Portal.Origin Prod]..NextInternalOrigin=launcher.store.epicgames.com/....[Portal.Origin Stage]..NextInternalOrigin=epicgames-stage.ol.epicgames.net/....[Portal.Origin GameDev]..NextInternalOrigin=epicgames-gamedev.ol.epicgames.net/....[Port

                                                                                                                            C:\ProgramData\Epic\EpicGamesLauncher\EpicOnlineServices.msi

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Epic Online Services, Author: Epic Games, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install Epic Online Services., Template: Intel;1033, Revision Number: {0AC89065-FDDB-45C2-88AB-02315AA8B5F5}, Create Time/Date: Wed Aug 2 20:37:38 2023, Last Saved Time/Date: Wed Aug 2 20:37:38 2023, Number of Pages: 405, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 4
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):134049792
                                                                                                                            Entropy (8bit):7.997723606903335
                                                                                                                            Encrypted:true
                                                                                                                            SSDEEP:3145728:6W+lu8efwAXA7FLjCt1Ond3xSQHVYX2ja6pBaWO5JZIwlnBaZ:6tcw8oFfie750+a6pF
                                                                                                                            MD5:1B44609A0998BAE367A4700EA7F5D6B2
                                                                                                                            SHA1:CD62B2C1B379A0B18ED14CECDAA4A1787DE20966
                                                                                                                            SHA-256:AE27108F40EC5DBB135CFF6F6FDBA238FF11C1DFD0F914A901BFCFD24DC79E0B
                                                                                                                            SHA-512:FE2FF76DF94A9E60C0BBB33698C03471C50D4ABD7DD6C5956050520B8E17F1E9C8C2E5E30D0A49C082FB6B83D71C81074B02DD09E5F58A55FEF480DD71A664D3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:......................>................... ................................................................ ...$...(...,...0...4...8...<...@...D...H...L...P...T...X...\...`...d...h...l...p...t...x...|..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\ProgramData\Epic\EpicGamesLauncher\InstallChainer.exe

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24016
                                                                                                                            Entropy (8bit):6.6592188895559685
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:bgaflz35DQD+Y3DGk8ZpH3GCJEFxExNG+Y3DGE1Fw8JN77hhFiB:bgaN5DIDGkiRBExDGyT3haB
                                                                                                                            MD5:4A3181A2E93579124799A9B81263768E
                                                                                                                            SHA1:33C8C8EBD802C3D802133AD10475F1DB0E5194C3
                                                                                                                            SHA-256:1130E54261ADD0069C5B700555631B780E950A3040E20F3AD6CC984F0251730E
                                                                                                                            SHA-512:50B1C8A4766E8C83382A5DF10DCA451F8FADD3B012CC2C82DEC9CFDB48D3B8F6DCAD26D8BAAD9C31426A3E04C6AD672EB599AB6A4EA1FB3A4188E622EAEA5B2E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\58e.........."...0..............6... ...@....@.. ..............................q.....`..................................6..O....@...............$...9...`......H5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................6......H........"..T............................................................0............i./.r...p..i.....(....s....z....(.....(....,.r&..ps....z....(.....rW..p(......r...po....,..(....-.(......(....,; ........s.......r...p....(....,.r...p.(....(......o.....+........(....s.....(.........o.....(....,.r#..pr...p.(....(....(....+9.(...... ......(....&..(........r...p...o....(....(........o .......,...o!........(.....(....-\.("...,Dr0..p....i.1-...+.......r2..p(#........X......i2...

                                                                                                                            C:\ProgramData\Epic\EpicGamesLauncher\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):190928
                                                                                                                            Entropy (8bit):5.969693507588729
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:6GfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01Kymka5M9:8zMRLkR6joxfRPoM9
                                                                                                                            MD5:735AC22B2774C06F1D46B6BF968B1B52
                                                                                                                            SHA1:DC003AD2EA8B9FA616E4F2189A0E4D0282174AF2
                                                                                                                            SHA-256:23376C15D8B1AC063E69251088081B879C575E133CBA252574B0CCFE81F289F2
                                                                                                                            SHA-512:B042E74082DF0AB2BF9A92559EC6A602C5E05CCA7F3B98562FF7CD53DDBE0893F105C1E0DD0A78EDC72E2B14FC635D9455B21ECB95EAADDBE4B3B52AC9CE055C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ..............................aq....@.................................(...O........................9.......................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:Certificate, Version=3
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1413
                                                                                                                            Entropy (8bit):7.480496427934893
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:yYvJm3RW857Ij3kTteTuQRFjGgZLE5XBy9+JYSE19rVAVsGnyI3SKB7:PL854TTuQL/ZoXQ9+mrGVrb3R
                                                                                                                            MD5:285EC909C4AB0D2D57F5086B225799AA
                                                                                                                            SHA1:D89E3BD43D5D909B47A18977AA9D5CE36CEE184C
                                                                                                                            SHA-256:68B9C761219A5B1F0131784474665DB61BBDB109E00F05CA9F74244EE5F5F52B
                                                                                                                            SHA-512:4CF305B95F94C7A9504C53C7F2DC8068E647A326D95976B7F4D80433B2284506FC5E3BB9A80A4E9A9889540BBF92908DD39EE4EB25F2566FE9AB37B4DC9A7C09
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:0...0..i.......9rD:.".Q..l..15.0...*.H........0{1.0...U....GB1.0...U....Greater Manchester1.0...U....Salford1.0...U....Comodo CA Limited1!0...U....AAA Certificate Services0...190312000000Z..281231235959Z0..1.0...U....US1.0...U....New Jersey1.0...U....Jersey City1.0...U....The USERTRUST Network1.0,..U...%USERTrust RSA Certification Authority0.."0...*.H.............0..........e.6......W.v..'.L.P.a. M.-d.....=.........{7(.+G.9.:.._..}..cB.v.;+...o... ..>..t.....bd......j."<......{......Q..gF.Q..T?.3.~l......Q.5..f.rg.!f..x..P:.....L....5.WZ....=.,..T....:M.L..\... =.."4.~;hf.D..NFS.3`...S7.sC.2.S...tNi.k.`.......2..;Qx.g..=V...i....%&k3m.nG.sC.~..f.)|2.cU.....T0....}7..]:l5\.A...I......b..f.%....?.9......L.|.k..^...g.....[..L..[...s.#;-..5Ut.I.IX...6.Q...&}.M....C&.A_@.DD...W..P.WT.>.tc/.Pe..XB.C.L..%GY.....&FJP...x..g...W...c..b.._U..\.(..%9..+..L...?.R.../..........0..0...U.#..0......#>.....)...0..0...U......Sy.Z.+J.T.......f.0...U...........0...U.......0....0...U

                                                                                                                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):250
                                                                                                                            Entropy (8bit):2.977287375524799
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:kkFklNljvMfllXlE/lQcjT18tlwiANjpU+plgh3VEkax3QbaLU15lqErtd9lytn:kKMfQAbjMulgokaWbLOW+n
                                                                                                                            MD5:50666FC23E630D8C7D506CBDAA5B253D
                                                                                                                            SHA1:65F4804D87D0AD533649B85CA5A05BB82F7E114A
                                                                                                                            SHA-256:719E793581C5D63E28F35C872490A515AFD4C58187FD279CD20548AB23129F64
                                                                                                                            SHA-512:C34F7107D0B124C1A36888AAF3777421F7008A4BBC45BA63762ED76961480FDBDB611FBA04DB4F5567058D0C4F6C47050402E5F9D0520F3FE5B18C0883B2581F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:p...... ....h..........(....................................................... .........(.f...@8..................h.t.t.p.:././.c.r.t...u.s.e.r.t.r.u.s.t...c.o.m./.U.S.E.R.T.r.u.s.t.R.S.A.A.d.d.T.r.u.s.t.C.A...c.r.t...".5.c.8.6.f.6.8.0.-.5.8.5."...

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\D3DCompiler_43.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2106216
                                                                                                                            Entropy (8bit):6.4563314852745375
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
                                                                                                                            MD5:1C9B45E87528B8BB8CFA884EA0099A85
                                                                                                                            SHA1:98BE17E1D324790A5B206E1EA1CC4E64FBE21240
                                                                                                                            SHA-256:2F23182EC6F4889397AC4BF03D62536136C5BDBA825C7D2C4EF08C827F3A8A1C
                                                                                                                            SHA-512:B76D780810E8617B80331B4AD56E9C753652AF2E55B66795F7A7D67D6AFCEC5EF00D120D9B2C64126309076D8169239A721AE8B34784B639B3A3E2BF50D6EE34
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h...;...;...;..];...;...;...;.._;...;..h;0..;..i;'..;..X;...;..l;D..;?M.;...;..Y;...;..^;...;Rich...;........PE..L...92.K...........!.........d...............................................p .....O. ...@.........................@.......@...P..................... .h............................................i..@............................................text...S........................... ..`.data....~.......B..................@....rsrc................(..............@..@.reloc..D............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\D3DCompiler_43_x86.cat

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6796
                                                                                                                            Entropy (8bit):7.242703752909775
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:Dm9WkVDPDaD9D743Ss/kPnE8UADPDaMm/D743bM5DODs+5cxzRWolNDPDaZD74oB:69VEQKPnEtObMacxc8hjXHUz1Tr2QRZ
                                                                                                                            MD5:11BC389F7A75423CEFA205BF3A404CE2
                                                                                                                            SHA1:3883969A816DB884A79E1B1ED8D2EC075D48F985
                                                                                                                            SHA-256:32000BAC9D162035751FE9016FC580D0CC0A643563C0F563D86D5FB83329E65F
                                                                                                                            SHA-512:0AC8F8FE65A449DBE175CA3B5A9269C7FAA65C852BCD41322FB0DA1B2FA2E52B468589399043C05070E57966559DB6F03D21270DCB26A7BEE0D09B2222905E6E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:0.....*.H.........y0..u...1.0...+......0.....+.....7......0...0...+.....7.........C..O..'..]G...100602115423Z0...+.....7.....0..L0..&.RA.0.D.C.F.D.F.1.0.4.C.6.F.9.2.5.F.4.D.E.E.D.8.3.B.3.1.B.1.C.9.E.4.A.D.1.B.E.F.B...1..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...............%......J..0....RE.A.5.D.8.B.B.B.F.1.3.1.3.4.3.D.D.0.D.D.B.2.0.7.3.D.C.B.B.7.6.3.4.E.6.B.C.E.C.C...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........]...14=...=.cNk..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0..0,..+.....7.....0....S.p.L.e.v.e.l........0...0D..+.....7....604...S.p.A.t.t.r........2.0.0.5.0.2.0.1.0.0.0.0.0.0...0....+.....7....x0v...O.S.A.t.t.r.......`2.:.5...0.,.2.:.5...1.,.2.:.5...2.,.2.:.5...x.,.2.:.6...x.,.2.:.7...x.,.2.:.8...x.,.2.:.9...x......10..`0..L...........

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\D3DCompiler_43_x86.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):801
                                                                                                                            Entropy (8bit):5.488673383707369
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:tsXnoqJhoaj2jt4sV3dGn8rZVI8h8rs37OL:2XthoaqjtV3dGnw+kOL
                                                                                                                            MD5:90785E792EDCFA7D43DE9DF2D1AC884D
                                                                                                                            SHA1:EA5D8BBBF131343DD0DDB2073DCBB7634E6BCECC
                                                                                                                            SHA-256:8F68CCDD8CE1ACFAA5C4AFAC6B2E96E23B7B532FBCBE9375709326083A134E85
                                                                                                                            SHA-512:A2D15DF6148B811AD5658D9692A737924A3CE3AE1007CD86B6AD994922D95D839258DD18D785425609970EFA8A39CA79FA61512F7908891CF51CD0EEB6AD2B15
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..[Version]..Signature = "$Windows NT$"..AdvancedINF = 2.0..Provider = %MSFT%..Class = %ExceptionClassDesc%..ClassGUID = {F5776D81-AE53-4935-8E84-B0B283D8BCEF}..CatalogFile = D3DCompiler_43_x86.cat..ComponentId = {C4F89AB5-99E9-4CD6-A760-F75EA57D0673}..DriverVer = 06-02-2010, 5.3.1.0904....[SourceDisksNames]..99 = %DiskName%,"JUN2010_D3DCompiler_43_x86.cab",0,,-1....[SourceDisksFiles]..D3DCompiler_43.dll = 99....[DestinationDirs]..DefaultDestDir = 11..DirectX_SysWOW64 = 10,SysWOW64....[x86_Install]..CopyFiles = DirectX_System....[x64_Install]..CopyFiles = DirectX_SysWOW64....[DirectX_System]..D3DCompiler_43.dll....[DirectX_SysWOW64]..D3DCompiler_43.dll....[Strings]..MSFT = "Microsoft"..ExceptionClassDesc = "DirectX JUN2010"..DiskName = "DirectX JUN2010 cab"....

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\D3DCompiler_43_x86_xp.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):572
                                                                                                                            Entropy (8bit):5.262759700206673
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:tsXnoHqqlaydGTFBngTrWgprCpt8e49pt8rs37O1B:tsXnoK0dGn8rZVI8h8rs37OL
                                                                                                                            MD5:269EE8EAE0AEB992621E80A3F1B2C501
                                                                                                                            SHA1:C1F1031B04E243F44C63AD762217D61D1FC41E58
                                                                                                                            SHA-256:EADF4D9537F17BB65FB811B7FD1C5248D6AE08DB5CF0F17E500F5CF73D685CCC
                                                                                                                            SHA-512:91003527430C9F15478ECA6FC950ACE7DB9156D38B172484C133601B18D5BF7FEE89F9B36379E723BF408F831B2860E39A1BC03F48C831615CE53CB521D20A87
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..[Version]..Signature = "$Windows NT$"..AdvancedINF = 2.0....[SourceDisksNames]..99 = %DiskName%,"JUN2010_D3DCompiler_43_x86.cab",0,,-1....[SourceDisksFiles]..D3DCompiler_43.dll = 99....[DestinationDirs]..DefaultDestDir = 11..DirectX_SysWOW64 = 10,SysWOW64....[x86_Install]..CopyFiles = DirectX_System....[x64_Install]..CopyFiles = DirectX_SysWOW64....[DirectX_System]..D3DCompiler_43.dll....[DirectX_SysWOW64]..D3DCompiler_43.dll....[Strings]..MSFT = "Microsoft"..ExceptionClassDesc = "DirectX JUN2010"..DiskName = "DirectX JUN2010 cab"....

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\JUN2010_D3DCompiler_43_x86.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1670
                                                                                                                            Entropy (8bit):5.353827430841304
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:0+KXIIO6eK/2FgBrW2F3BLO2F+n2FZZ2Fre2FtW2FO:iXIj6eK/2Fg82F3NO2F+n2FZZ2Fre2FK
                                                                                                                            MD5:1A86443FC4E07E0945904DA7EFE2149D
                                                                                                                            SHA1:37A6627DBF3B43ACA104EB55F9F37E14947838CE
                                                                                                                            SHA-256:5DD568919E1B3CBCB23AB21D0F2D6C1A065070848ABA5D2A896DA39E55C6CBBF
                                                                                                                            SHA-512:C9FAA6BB9485B1A0F8356DF42C1EFE1711A77EFA566EEE3EB0C8031ECE10FFA045D35ADB63E5E8B2F79F26BF3596C54C0BD23FEA1642FAAE11BAF2E97B73CF5E
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..; ---- Common sections ----..[Version]..Signature = "$CHICAGO$"..AdvancedINF = 2.0..Provider = %MSFT%..SetupClass = BASE....[Strings]..MSFT = "Microsoft"......; ---- Windows 2000 ----..[4.09.00.0904.00-4.09.00.0904.00_Win2K]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..D3DCompiler_43_x86_xp.inf, x86_Install......; ---- Windows XP ----..[4.09.00.0904.00-4.09.00.0904.00_WinXP]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..D3DCompiler_43_x86_xp.inf, x86_Install......; ---- Windows XP 64bit ----..[4.09.00.0904.00-4.09.00.0904.00_WinXP@64]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..D3DCompiler_43_x86_xp.inf, x64_Install......; ---- Windows Server 2003 ----..[4.09.00.0904.00-4.09.00.0904.00_Srv2K3]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..D3DCompiler_43_x86_xp.inf, x86_install......;

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\JUN2010_d3dcsx_43_x86.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1635
                                                                                                                            Entropy (8bit):5.347501446123384
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:0+KXIIO6eK/2AgBrW2A3BLO2A+n2AZZ2Are2AtW2AO:iXIj6eK/2Ag82A3NO2A+n2AZZ2Are2AB
                                                                                                                            MD5:CF70B3DD13A8C636DB00BD4332996D1A
                                                                                                                            SHA1:48DD8FC6FA3DAE23CB6CA8113BC7AD837B4570D7
                                                                                                                            SHA-256:D5200B332CAF4FFF25EB3D224527A3944878C5C3849512779A2AFCFEAE4C3CA1
                                                                                                                            SHA-512:AE31A9E20743A2052DEEC5D696A555460A03D400720679ED103759241B25D55E2FBC247170DA3C0C0891F32B131AB6A6845DE56C2D3387AD233AA11DB970B313
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..; ---- Common sections ----..[Version]..Signature = "$CHICAGO$"..AdvancedINF = 2.0..Provider = %MSFT%..SetupClass = BASE....[Strings]..MSFT = "Microsoft"......; ---- Windows 2000 ----..[4.09.00.0904.00-4.09.00.0904.00_Win2K]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dcsx_43_x86_xp.inf, x86_Install......; ---- Windows XP ----..[4.09.00.0904.00-4.09.00.0904.00_WinXP]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dcsx_43_x86_xp.inf, x86_Install......; ---- Windows XP 64bit ----..[4.09.00.0904.00-4.09.00.0904.00_WinXP@64]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dcsx_43_x86_xp.inf, x64_Install......; ---- Windows Server 2003 ----..[4.09.00.0904.00-4.09.00.0904.00_Srv2K3]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dcsx_43_x86_xp.inf, x86_install......; ---- Windows Server

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\JUN2010_d3dx10_43_x86.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1635
                                                                                                                            Entropy (8bit):5.334993389233006
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:0+KXIIO6eK/2ngBrW2n3BLO2n+n2nZZ2nre2ntW2nO:iXIj6eK/2ng82n3NO2n+n2nZZ2nre2ns
                                                                                                                            MD5:53A24FAEE760E18821EF0960C767AB04
                                                                                                                            SHA1:4548DB4234DBACBFB726784B907D08D953496FF9
                                                                                                                            SHA-256:4D4263CBB11858C727824C4A071F992909675719BE3076B4A47852BF6AFFD862
                                                                                                                            SHA-512:8371471624F54DB0ACA3EA051235937FC28575C0F533B89F7D2204C776814D4CD09EE1A37B41163239885E878FB193133AD397FE3C18232AD3469626AF2D2ED1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..; ---- Common sections ----..[Version]..Signature = "$CHICAGO$"..AdvancedINF = 2.0..Provider = %MSFT%..SetupClass = BASE....[Strings]..MSFT = "Microsoft"......; ---- Windows 2000 ----..[4.09.00.0904.00-4.09.00.0904.00_Win2K]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dx10_43_x86_xp.inf, x86_Install......; ---- Windows XP ----..[4.09.00.0904.00-4.09.00.0904.00_WinXP]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dx10_43_x86_xp.inf, x86_Install......; ---- Windows XP 64bit ----..[4.09.00.0904.00-4.09.00.0904.00_WinXP@64]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dx10_43_x86_xp.inf, x64_Install......; ---- Windows Server 2003 ----..[4.09.00.0904.00-4.09.00.0904.00_Srv2K3]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dx10_43_x86_xp.inf, x86_install......; ---- Windows Server

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\JUN2010_d3dx11_43_x86.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1635
                                                                                                                            Entropy (8bit):5.3452018288502385
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:0+KXIIO6eK/2wgBrW2w3BLO2w+n2wZZ2wre2wtW2wO:iXIj6eK/2wg82w3NO2w+n2wZZ2wre2w5
                                                                                                                            MD5:FB5D27C88B52DCBDBC226F66F0537573
                                                                                                                            SHA1:2CBF1012FBDCBBD17643F7466F986ECD3CE2688A
                                                                                                                            SHA-256:3925C924EB4EC4F5A643B2D14D2EDA603341FBBD22118CDD8AE04AAA96F443C0
                                                                                                                            SHA-512:8AA2200F91ECA91D7EE3221BC7C8F2A9C8D913A5D633AA00835D5FB243D9CB8AFA60FE34A4C3DAA0731A21914BC52266D05D6B80BFC30B2A255D7ACDF0D18EB5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..; ---- Common sections ----..[Version]..Signature = "$CHICAGO$"..AdvancedINF = 2.0..Provider = %MSFT%..SetupClass = BASE....[Strings]..MSFT = "Microsoft"......; ---- Windows 2000 ----..[4.09.00.0904.00-4.09.00.0904.00_Win2K]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dx11_43_x86_xp.inf, x86_Install......; ---- Windows XP ----..[4.09.00.0904.00-4.09.00.0904.00_WinXP]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dx11_43_x86_xp.inf, x86_Install......; ---- Windows XP 64bit ----..[4.09.00.0904.00-4.09.00.0904.00_WinXP@64]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dx11_43_x86_xp.inf, x64_Install......; ---- Windows Server 2003 ----..[4.09.00.0904.00-4.09.00.0904.00_Srv2K3]..NumberOfFiles=5..Size=1503 ;approximately total file size (Size * 1024 bytes)..CopyCount=2..d3dx11_43_x86_xp.inf, x86_install......; ---- Windows Server

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\apr2007_xinput_x86.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1431
                                                                                                                            Entropy (8bit):5.359559696538983
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:M5+gJXIIO6eUBrH2q9vxBLP2q9vnE82q9vLzO2q9vJf2q9vjH2q9vs:0+KXIIO6eUBrWQxBLOQEnQ3ZQJeQjWQs
                                                                                                                            MD5:E188F534500688CEC2E894D3533997B4
                                                                                                                            SHA1:F073F8515B94CB23B703AB5CDB3A5CFCC10B3333
                                                                                                                            SHA-256:1C798CB80E9E46CE03356EA7316E1EFF5D3A88CCDD7CBFBFCDCE73CDED23B4E5
                                                                                                                            SHA-512:332CCB25C5ED92AE48C5805A330534D985D6B41F9220AF0844D407B2019396FCEFEA7076B409439F5AB8A9CA6819B65C07ADA7BD3AA1222429966DC5A440D4F7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..; ---- Common sections ----..[Version]..Signature = "$CHICAGO$"..AdvancedINF = 2.0..Provider = %MSFT%..SetupClass = BASE....[Strings]..MSFT = "Microsoft"......; ---- Windows XP ----..[4.09.00.0904.00-4.09.00.0904.00_WinXP]..NumberOfFiles=5..Size=487 ;approximately total file size (Size * 1024 bytes)..CopyCount=1..xinput1_3_x86_xp.inf, x86_Install......; ---- Windows XP 64bit ----..[4.09.00.0904.00-4.09.00.0904.00_WinXP@64]..NumberOfFiles=5..Size=487 ;approximately total file size (Size * 1024 bytes)..CopyCount=1..xinput1_3_x86_xp.inf, x64_Install......; ---- Windows Server 2003 ----..[4.09.00.0904.00-4.09.00.0904.00_Srv2K3]..NumberOfFiles=5..Size=487 ;approximately total file size (Size * 1024 bytes)..CopyCount=1..xinput1_3_x86_xp.inf, x86_Install......; ---- Windows Server 2003 64bit ----..[4.09.00.0904.00-4.09.00.0904.00_Srv2K3@64]..NumberOfFiles=5..Size=487 ;approximately total file size (Size * 1024 bytes)..CopyCount=1..xinput1_3_x86_xp.inf, x64_install......; ---- W

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dcsx_43.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1868128
                                                                                                                            Entropy (8bit):6.25014757191993
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24576:/j0ZXvi+of1/z+uQ5Da3Qx1fF4dEQMtqVC43ux:/A9i/f1/z+Zce4dpMATe
                                                                                                                            MD5:83EBA442F07AAB8D6375D2EEC945C46C
                                                                                                                            SHA1:C29C20DA6BB30BE7D9DDA40241CA48F069123BD9
                                                                                                                            SHA-256:B46A44B6FCE8F141C9E02798645DB2EE0DA5C69EA71195E29F83A91A355FA2CA
                                                                                                                            SHA-512:288906C8AA8EB4D62440FE84DEAA25E7F362DC3644DAFC1227E45A71F6D915ACF885314531DB4757A9BF2E6CB12EAF43B54E9FF0F6A7E3239CABB697B07C25EA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...E...E...E....$..E...E..]E....&..E.......E....!..E.......E......E.... ..E....'..E..Rich.E..........................PE..L....1.K...........!.........f......Mf....... ............................................@.........................0...X.......<....`...............j..`....p......P................................d..@............... ............................text............................... ..`.data....3... ...0..................@....rsrc........`.......8..............@..@.reloc...,...p.......<..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dcsx_43_x86.cat

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6796
                                                                                                                            Entropy (8bit):7.257834337832179
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:3zm3VkWkVDPDaD9D743Ss/kPnE8UADPDaMm/D743bM5DODs+5cxzRWolNDPDaZD9:a3VkVEQKPnEtObMacxc8hjeyveCXEt
                                                                                                                            MD5:AAED60FCF2BCF700D8F17500DAD6DC95
                                                                                                                            SHA1:DAC96B0992E12298F17067DD9FA8C50EDCBC2297
                                                                                                                            SHA-256:7F8A33984E71CFD932417DD3081C71B798B31A57DEC96CA2D5982584A0B69728
                                                                                                                            SHA-512:13B8F5BD490D51F22A8234D089A9913756AD00AECD3A25E1C1CBE220B341FF65148B8ADC37EF64DEE203883E727CA3840E12D589E17F4A4ADEE728BA9CE2F1D7
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:0.....*.H.........y0..u...1.0...+......0.....+.....7......0...0...+.....7..... .e\(..I...E.]x@..100602115423Z0...+.....7.....0..L0..&.R2.C.5.3.0.F.E.1.6.A.C.7.2.D.D.8.9.6.8.1.B.A.6.B.1.9.5.1.B.E.4.4.9.D.3.8.F.D.D.2...1..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........,S..j.-...k.Q.D.8..0....RF.F.3.2.9.6.9.8.0.7.4.9.6.5.4.9.3.1.2.8.E.6.2.7.F.7.7.0.B.9.B.3.E.4.4.4.F.8.1.3...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........2...IeI1(.'.p...D..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0..0,..+.....7.....0....S.p.L.e.v.e.l........0...0D..+.....7....604...S.p.A.t.t.r........2.0.0.5.0.2.0.1.0.0.0.0.0.0...0....+.....7....x0v...O.S.A.t.t.r.......`2.:.5...0.,.2.:.5...1.,.2.:.5...2.,.2.:.5...x.,.2.:.6...x.,.2.:.7...x.,.2.:.8...x.,.2.:.9...x......10..`0..L...........

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dcsx_43_x86.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):776
                                                                                                                            Entropy (8bit):5.483347321437731
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:tsXnoqJhoaj1FsVCdJn8rZVI8h8rsg7pL:2XthoahiVCdJnw+xpL
                                                                                                                            MD5:DDBFC2923DF1263BD87AC1BDBA534D4A
                                                                                                                            SHA1:FF329698074965493128E627F770B9B3E444F813
                                                                                                                            SHA-256:48EC353B9C9FBF9EC8692C5D6462C7E4FDB726E7A0B0ABD734F33F9E5F0ACE56
                                                                                                                            SHA-512:F10220C3F33CF1DA56C4FF580DA322923B5CDAC25BD1C8D0B4F8F0BF456397A4DD32A21E7B731306ED5E01A2B832ACEC7044D7337911E7F4649CDB6F6D37F603
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..[Version]..Signature = "$Windows NT$"..AdvancedINF = 2.0..Provider = %MSFT%..Class = %ExceptionClassDesc%..ClassGUID = {F5776D81-AE53-4935-8E84-B0B283D8BCEF}..CatalogFile = d3dcsx_43_x86.cat..ComponentId = {6D337D2E-C4CC-454A-B384-939F934DDD72}..DriverVer = 06-02-2010, 5.3.1.0904....[SourceDisksNames]..99 = %DiskName%,"JUN2010_d3dcsx_43_x86.cab",0,,-1....[SourceDisksFiles]..d3dcsx_43.dll = 99....[DestinationDirs]..DefaultDestDir = 11..DirectX_SysWOW64 = 10,SysWOW64....[x86_Install]..CopyFiles = DirectX_System....[x64_Install]..CopyFiles = DirectX_SysWOW64....[DirectX_System]..d3dcsx_43.dll....[DirectX_SysWOW64]..d3dcsx_43.dll....[Strings]..MSFT = "Microsoft"..ExceptionClassDesc = "DirectX JUN2010"..DiskName = "DirectX JUN2010 cab"....

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dcsx_43_x86_xp.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):552
                                                                                                                            Entropy (8bit):5.261658761807364
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:tsXnoHqqlWdGTFkngTrWgprCpt8e49pt8rsg7p1B:tsXnoKrdJn8rZVI8h8rsg7pL
                                                                                                                            MD5:0AE2ECCF1418E98849B2973C4225AEB5
                                                                                                                            SHA1:78C4661DCC0DA0C7DFC6B67A50F11E54CFE72B78
                                                                                                                            SHA-256:2CA1181A9E4D4610557C4203C513D1EBD26D8EC9E0C2366271816044E3CDCAB6
                                                                                                                            SHA-512:4CED16CD9A097F19DE3C3E0E58B2F83EC2EA7D88E5A3AA6867AAC3168D3A176D6645B74FE76135E8A5F294256E0F72F7E537563327F47FA91CB95B90B5F78FFB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..[Version]..Signature = "$Windows NT$"..AdvancedINF = 2.0....[SourceDisksNames]..99 = %DiskName%,"JUN2010_d3dcsx_43_x86.cab",0,,-1....[SourceDisksFiles]..d3dcsx_43.dll = 99....[DestinationDirs]..DefaultDestDir = 11..DirectX_SysWOW64 = 10,SysWOW64....[x86_Install]..CopyFiles = DirectX_System....[x64_Install]..CopyFiles = DirectX_SysWOW64....[DirectX_System]..d3dcsx_43.dll....[DirectX_SysWOW64]..d3dcsx_43.dll....[Strings]..MSFT = "Microsoft"..ExceptionClassDesc = "DirectX JUN2010"..DiskName = "DirectX JUN2010 cab"....

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx10_43.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):470880
                                                                                                                            Entropy (8bit):6.715347536118646
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12288:cFUDOgwNvArf8r3bK9s3kW3CG3vQ3sad/QNbubxu:5DOgw6fYbK9s3kW3CG3vQ3snputu
                                                                                                                            MD5:20C835843FCEC4DEDFCD7BFFA3B91641
                                                                                                                            SHA1:5DD1D5B42A0B58D708D112694394A9A23691C283
                                                                                                                            SHA-256:56FCD13650FD1F075743154E8C48465DD68A236AB8960667D75373139D2631BF
                                                                                                                            SHA-512:561EB2BB3A7E562BAB0DE6372E824F65B310D96D840CDAA3C391969018AF6AFBA225665D07139FC938DCFF03F4F8DAE7F19DE61C9A0EAE7C658A32800DC9D123
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o..?+.nl+.nl+.nl+.ol..nl...l .nl...lk.nl...l$.nl...l*.nl...l{.nl.S.l*.nl...l*.nl...l*.nlRich+.nl........PE..L..../.K...........!.................9.......................................@...........@..........................v..%....k..x.......................`........0.....................................@............................................text....~.......................... ..`.data....].......V..................@....rsrc...............................@..@.reloc...9.......:..................@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx10_43_x86.cat

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6796
                                                                                                                            Entropy (8bit):7.254765641833245
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:NbVvVEQKPnEtObMacxc8hjXHUz1Tr2K4ms6W:L9ELXci2jXHU7s7
                                                                                                                            MD5:4B9EDAB17511C7AD0D4753E215160C0A
                                                                                                                            SHA1:DBCE3E783F5C24A611D3025155381264D840CAE3
                                                                                                                            SHA-256:EB374DB35DF2DE925C71B3AFFA8D9248D68E6005B2015BACC6A6E5A13EE4B046
                                                                                                                            SHA-512:D8B97FBEEAE38FE80439CD7589C574FA7FFB81C94494CA507ECDE3F7F5DA948EB54DCA63FD0A633B966494E00B7B8EE3C4F7826F681768C735E04EF97907D6BF
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:0.....*.H.........y0..u...1.0...+......0.....+.....7......0...0...+.....7..........[.H.....A.j..100602115422Z0...+.....7.....0..L0..&.R4.9.8.6.2.E.C.6.9.E.A.9.7.2.B.E.4.8.9.5.5.0.B.C.2.1.C.C.D.D.5.4.E.A.B.6.B.5.5.9...1..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........I....r.H.P.!..T.Y0....R6.9.8.7.0.C.9.1.E.5.9.B.0.E.A.C.C.4.E.8.8.B.D.2.D.4.F.9.5.E.7.5.6.1.F.6.3.0.F.E...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........i...........^ua.0.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0..0,..+.....7.....0....S.p.L.e.v.e.l........0...0D..+.....7....604...S.p.A.t.t.r........2.0.0.5.0.2.0.1.0.0.0.0.0.0...0....+.....7....x0v...O.S.A.t.t.r.......`2.:.5...0.,.2.:.5...1.,.2.:.5...2.,.2.:.5...x.,.2.:.6...x.,.2.:.7...x.,.2.:.8...x.,.2.:.9...x......10..`0..L...........

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx10_43_x86.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):776
                                                                                                                            Entropy (8bit):5.486519677108282
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:tsXnoqJhoajifNsVJd6tn8rZVI8h8rspN7O5L:2XthoaefaVJd8nw+KIL
                                                                                                                            MD5:24338A297E69E534524A71CD5AD543C3
                                                                                                                            SHA1:69870C91E59B0EACC4E88BD2D4F95E7561F630FE
                                                                                                                            SHA-256:ED1429A15B15A28F2E6A92DA669A205594D09625CBFCDBF0159516A813A6F5D4
                                                                                                                            SHA-512:8BB4AE9C72909C6B8BEB6CA675C007317903869BA56F549D9C2FF48A1FB50923B98B6F748E99BFD56B4B068E14C8773E9BF4DCDF5EB6CCB8B0EDD6A0B16DECC0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..[Version]..Signature = "$Windows NT$"..AdvancedINF = 2.0..Provider = %MSFT%..Class = %ExceptionClassDesc%..ClassGUID = {F5776D81-AE53-4935-8E84-B0B283D8BCEF}..CatalogFile = d3dx10_43_x86.cat..ComponentId = {F191D5F9-6D74-445e-9100-64D61DCD95CA}..DriverVer = 06-02-2010, 5.3.1.0904....[SourceDisksNames]..99 = %DiskName%,"JUN2010_d3dx10_43_x86.cab",0,,-1....[SourceDisksFiles]..d3dx10_43.dll = 99....[DestinationDirs]..DefaultDestDir = 11..DirectX_SysWOW64 = 10,SysWOW64....[x86_Install]..CopyFiles = DirectX_System....[x64_Install]..CopyFiles = DirectX_SysWOW64....[DirectX_System]..d3dx10_43.dll....[DirectX_SysWOW64]..d3dx10_43.dll....[Strings]..MSFT = "Microsoft"..ExceptionClassDesc = "DirectX JUN2010"..DiskName = "DirectX JUN2010 cab"....

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx10_43_x86_xp.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):552
                                                                                                                            Entropy (8bit):5.278909977985311
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:tsXnoHqqltdGTFUMtngTrWgprCpt8e49pt8rsmMN75M51B:tsXnoKgd6tn8rZVI8h8rspN7O5L
                                                                                                                            MD5:C6F443FD35C24CFCD2E9E906CA19B6B6
                                                                                                                            SHA1:2B74782DDDDFE4878319AF93B03CC5DB35EFDF83
                                                                                                                            SHA-256:74F3CC9F80A479FCB4954813DF9AC71085BF407E7B8B447B7ACE3C30E08E6F85
                                                                                                                            SHA-512:9C529C7DCA0A4F1C18B394AB4D7AA956B3B154889485C2D9F0D65C4CD45A2F040237512AF2BF61EF155724E0D7401BE4B09CBA96614A493DEFB738028637797D
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..[Version]..Signature = "$Windows NT$"..AdvancedINF = 2.0....[SourceDisksNames]..99 = %DiskName%,"JUN2010_d3dx10_43_x86.cab",0,,-1....[SourceDisksFiles]..d3dx10_43.dll = 99....[DestinationDirs]..DefaultDestDir = 11..DirectX_SysWOW64 = 10,SysWOW64....[x86_Install]..CopyFiles = DirectX_System....[x64_Install]..CopyFiles = DirectX_SysWOW64....[DirectX_System]..d3dx10_43.dll....[DirectX_SysWOW64]..d3dx10_43.dll....[Strings]..MSFT = "Microsoft"..ExceptionClassDesc = "DirectX JUN2010"..DiskName = "DirectX JUN2010 cab"....

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx11_43.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):248672
                                                                                                                            Entropy (8bit):6.540646534165038
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6144:8K0GaAtQlDJCSB4MvfIeDRI9Z7IJItblSwJ7FnH4fa1wlMjb5:eGjQlDkSB4MvfIeDRI9Z7IJIRlfJ7N4w
                                                                                                                            MD5:8E0BB968FF41D80E5F2C747C04DB79AE
                                                                                                                            SHA1:69B332D78020177A9B3F60CB672EC47578003C0D
                                                                                                                            SHA-256:492E960CB3CCFC8C25FC83F7C464BA77C86A20411347A1A9B3E5D3E8C9180A8D
                                                                                                                            SHA-512:7D71CB5411F239696E77FE57A272C675FE15D32456CE7BEFB0C2CF3FC567DCE5D38A45F4B004577E3DEC283904F42AE17A290105D8AB8EF6B70BAD4E15C9D506
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.c.0..Z0..Z0..Z.Z9..Z0..Z...Z.Z9..Z.Zp..Z.Z1..Z.Z...Z.6sZ1..Z.Z1..Z.Z1..ZRich0..Z........PE..L....1.K...........!.....6...|......F........P............................................@..........................<..E...T5..d.......................`.......`...................................`...@...............P............................text...%4.......6.................. ..`.data....S...P...R...:..............@....rsrc...............................@..@.reloc...".......$..................@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx11_43_x86.cat

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):6796
                                                                                                                            Entropy (8bit):7.252886544623485
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:RSzM5EQKPnEtObMacxc8hjXHUz1Tr22SM:NELXci2jXHULb
                                                                                                                            MD5:8731DC141C5F490C84DE170F78D122C7
                                                                                                                            SHA1:99D83EA9BDDDB7636E926811700973FDBAC501CA
                                                                                                                            SHA-256:ACA973753DACD00F19A10733F900CD4A0CE6F6A202B4CD82B02A06D6EA8D92F8
                                                                                                                            SHA-512:CC1F2F0C8DF1AA87D01D86946AA1312D7A737790A2ACC1A3770F8066D9B34B6CD492EA8B5DA16D68ED2F8E6DA190E7B64AC4C65AC88C1B45D9660BE5F78C1649
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:0.....*.H.........y0..u...1.0...+......0.....+.....7......0...0...+.....7..........(A.&n|.....100602115422Z0...+.....7.....0..L0....R2.E.3.F.0.4.2.2.E.8.8.D.6.D.B.E.A.F.8.2.1.1.D.7.D.C.E.7.B.3.8.D.3.0.4.8.C.4.3.3...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........?.".m.......0H.30b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..&.R3.E.A.C.F.B.B.6.7.0.F.6.6.5.3.4.9.C.0.A.2.1.6.9.7.E.2.3.E.4.0.7.4.9.B.9.C.0.4.E...1..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........>...p.e4..!i~#..I..N....0..0,..+.....7.....0....S.p.L.e.v.e.l........0...0D..+.....7....604...S.p.A.t.t.r........2.0.0.5.0.2.0.1.0.0.0.0.0.0...0....+.....7....x0v...O.S.A.t.t.r.......`2.:.5...0.,.2.:.5...1.,.2.:.5...2.,.2.:.5...x.,.2.:.6...x.,.2.:.7...x.,.2.:.8...x.,.2.:.9...x......10..`0..L...........

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx11_43_x86.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):776
                                                                                                                            Entropy (8bit):5.5085250435289606
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:tsXnoqJhoajRkN+GsVadhn8rZVI8h8rss7BL:2XthoaNkExVadhnw+ZBL
                                                                                                                            MD5:5F043E62B5CC2F3D578E8F58AAA09FBA
                                                                                                                            SHA1:2E3F0422E88D6DBEAF8211D7DCE7B38D3048C433
                                                                                                                            SHA-256:025CFD736326445F5D98D8DFC8584189F8EEBB2D5F3E3CD25A6F386BC2496958
                                                                                                                            SHA-512:D1AF12375E5169525464DD17DEC6F6EC437B6A35DB6C425D508FA694B506F302B8A72E3F2222467E2CD98346F017A83B5149B80FC8C06B06320EC9E265280680
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..[Version]..Signature = "$Windows NT$"..AdvancedINF = 2.0..Provider = %MSFT%..Class = %ExceptionClassDesc%..ClassGUID = {F5776D81-AE53-4935-8E84-B0B283D8BCEF}..CatalogFile = d3dx11_43_x86.cat..ComponentId = {948C45ED-E04A-48A8-A895-EEC45A7D221B}..DriverVer = 06-02-2010, 5.3.1.0904....[SourceDisksNames]..99 = %DiskName%,"JUN2010_d3dx11_43_x86.cab",0,,-1....[SourceDisksFiles]..d3dx11_43.dll = 99....[DestinationDirs]..DefaultDestDir = 11..DirectX_SysWOW64 = 10,SysWOW64....[x86_Install]..CopyFiles = DirectX_System....[x64_Install]..CopyFiles = DirectX_SysWOW64....[DirectX_System]..d3dx11_43.dll....[DirectX_SysWOW64]..d3dx11_43.dll....[Strings]..MSFT = "Microsoft"..ExceptionClassDesc = "DirectX JUN2010"..DiskName = "DirectX JUN2010 cab"....

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\d3dx11_43_x86_xp.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):552
                                                                                                                            Entropy (8bit):5.277146898626137
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:tsXnoHqql+dGTFULngTrWgprCpt8e49pt8rsm37571B:tsXnoKXdhn8rZVI8h8rss7BL
                                                                                                                            MD5:6984C5F943AF5FCE6FD432A4F4F74259
                                                                                                                            SHA1:A785B65C7E0E1166A5E43DE4AEB13E5441E8898B
                                                                                                                            SHA-256:F2DBCB36E32847488C27792CD391E3E17DEBA31FF1F0FEB002A2E9A7EDBA6376
                                                                                                                            SHA-512:61C79578BEEB811F744C6EF97DDC2B8D357956AA16F2E5F0ABC1271A65390B160135B105756836B528F1C0EF16AB4B106B064B7C7A71E1C0F30CC42FC4477904
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..[Version]..Signature = "$Windows NT$"..AdvancedINF = 2.0....[SourceDisksNames]..99 = %DiskName%,"JUN2010_d3dx11_43_x86.cab",0,,-1....[SourceDisksFiles]..d3dx11_43.dll = 99....[DestinationDirs]..DefaultDestDir = 11..DirectX_SysWOW64 = 10,SysWOW64....[x86_Install]..CopyFiles = DirectX_System....[x64_Install]..CopyFiles = DirectX_SysWOW64....[DirectX_System]..d3dx11_43.dll....[DirectX_SysWOW64]..d3dx11_43.dll....[Strings]..MSFT = "Microsoft"..ExceptionClassDesc = "DirectX JUN2010"..DiskName = "DirectX JUN2010 cab"....

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\dxupdate.cif

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):66865
                                                                                                                            Entropy (8bit):5.567626982635727
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:Wn+OeDyG6lG9CVGQM6UP8XUUkw8KlNxLkPkjdARflPp0VZRTBM9oZPFASJu71N1F:V
                                                                                                                            MD5:B36D3F105D18E55534AD605CBF061A92
                                                                                                                            SHA1:788EF2DE1DEA6C8FE1D23A2E1007542F7321ED79
                                                                                                                            SHA-256:C6C5E877E92D387E977C135765075B7610DF2500E21C16E106A225216E6442AE
                                                                                                                            SHA-512:35AE00DA025FD578205337A018B35176095A876CD3C3CF67A3E8A8E69CD750A4CCC34CE240F11FAE3418E5E93CAF5082C987F0C63F9D953ED7CB8D9271E03B62
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..[Version]..Signature=$Chicago$..DisplayName=%SetupTitle%..MinFileSize=2000....[DirectX]..SectionType=Group..Priority=100..DisplayName=%DirectX%....[DXUpdate_Feb2005_x86]..DisplayName=%Feb2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=990,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="Feb2005_d3dx9_24_x86.cab",3..Version=4,09,00,0904....[DXUpdate_Feb2005_x64]..DisplayName=%Feb2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=1220,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="Feb2005_d3dx9_24_x64.cab",3..Version=4,09,00,0904....[DXUpdate_Apr2005_x86]..DisplayName=%Apr2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=1055,0..GUID={44BBA855-CC51-11CF-AAFA-00AA00B6015C}..URL1="Apr2005_d3dx9_25_x86.cab",3..Version=4,09,00,0904....[DXUpdate_Apr2005_x64]..DisplayName=%Apr2005%..Details=%DirectX_Desc%..SectionType=Component..Platform=NT5..Group=DirectX..Size=1317

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\dxupdate.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):177152
                                                                                                                            Entropy (8bit):6.549767948531931
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq
                                                                                                                            MD5:7ED554B08E5B69578F9DE012822C39C9
                                                                                                                            SHA1:036D04513E134786B4758DEF5AFF83D19BF50C6E
                                                                                                                            SHA-256:FB4F297E295C802B1377C6684734B7249D55743DFB7C14807BEF59A1B5DB63A2
                                                                                                                            SHA-512:7AF5F9C4A3AD5C120BCDD681B958808ADA4D885D21AEB4A009A36A674AD3ECE9B51837212A982DB6142A6B5580E5B68D46971B802456701391CE40785AE6EBD9
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............M...M...M.CM...M...MJ..M...M...M...M...M...M...M..KM...M..zM...M..{M...M..JM...M..MM...MRich...M................PE..L......M...........!.....j...n............................................................@.........................pw..V....j..........8.......................X...p...................................@...............8............................text....h.......j.................. ..`.data....:...........n..............@....rsrc...8...........................@..@.reloc..0&.......(..................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\dxupdate.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12848
                                                                                                                            Entropy (8bit):5.071095411173453
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
                                                                                                                            MD5:E6A74342F328AFA559D5B0544E113571
                                                                                                                            SHA1:A08B053DFD061391942D359C70F9DD406A968B7D
                                                                                                                            SHA-256:93F5589499EE4EE2812D73C0D8FEACBBCFE8C47B6D98572486BC0EFF3C5906CA
                                                                                                                            SHA-512:1E35E5BDFF1D551DA6C1220A1A228C657A56A70DEDF5BE2D9273FC540F9C9F0BB73469595309EA1FF561BE7480EE92D16F7ACBBD597136F4FC5F9B8B65ECDFAD
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..; ---- Common sections ----..[Version]..Signature = "$CHICAGO$"..AdvancedINF = 2.0..Provider = %MSFT%..SetupClass = BASE....[Strings]..MSFT = "Microsoft"....[MDXDLLs]..Microsoft.DirectX.AudioVideoPlayback.dll..Microsoft.DirectX.Diagnostics.dll..Microsoft.DirectX.Direct3D.dll..Microsoft.DirectX.Direct3DX.dll..Microsoft.DirectX.DirectDraw.dll..Microsoft.DirectX.DirectInput.dll..Microsoft.DirectX.DirectPlay.dll..Microsoft.DirectX.DirectSound.dll..Microsoft.DirectX.dll......; ---- Windows 98 ----..[4.09.00.0904.00-4.09.00.0904.00_Win98_Feb2005_d3dx9_24_x86.cab]..NumberOfFiles=4..Size=2178 ;approximately total file size (Size * 1024 bytes)..CopyCount=1..d3dx9_24_w9x.inf....[4.09.00.0904.00-4.09.00.0904.00_Win98_Feb2005_MDX_x86.MSI]..NumberOfFiles=1..Size=1788 ;approximately total file size (Size * 1024 bytes)..CopyCount=1..Dependencies=feb2005_d3dx9_24_x86.cab..Feb2005_MDX_x86.MSI......; ---- Windows ME ----..[4.09.00.0904.00-4.09.00.0904.00_WinME_Feb2005_d3dx9_24_x86.cab]..N

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\xinput1_3.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):81768
                                                                                                                            Entropy (8bit):6.4167890753768395
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:TVeqvNS6T6jxeEsU6b0xZtDDVb9X8u9JA7zitdrz/R8cy/FaeBD:TVeqvNOeFgxZ9DVVtRBy/EeD
                                                                                                                            MD5:77F595DEE5FFACEA72B135B1FCE1312E
                                                                                                                            SHA1:D2A710B332DE3EF7A576E0AED27B0AE66892B7E9
                                                                                                                            SHA-256:8D540D484EA41E374FD0107D55D253F87DED4CE780D515D8FD59BBE8C98970A7
                                                                                                                            SHA-512:A8683050D7758C248052C11AC6A46C9A0B3B3773902CCA478C1961B6D9D2D57C75A8C925BA5AF4499989C0F44B34EAF57ABAFAFA26506C31E5E4769FB3439746
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M..i#Y.i#Y.i#Y.i"Y.i#Y.f~Y.i#Y.f,Y.i#Y.f|Y.i#Y.f.Y.i#Y.fCY.i#Y.f}Y.i#Y.fyY.i#YRich.i#Y........................PE..L...5S.F...........!.........F....................@..........................`..................................................d....0..................h%...@..8....................................&..@...............\............................text...j........................... ..`.data....+..........................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\xinput1_3_x86.cat

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):10392
                                                                                                                            Entropy (8bit):7.308938023050865
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:Hu8+s9dsGEo6opz+Hz+ehjuOu39DKmHj70dpQ:b+sfhnhu1jRaeWb
                                                                                                                            MD5:D0C1F2FB476CDDA4CCE9DEB7856500DA
                                                                                                                            SHA1:05365C782FCA083F03C5714C5067ADA547B44CAC
                                                                                                                            SHA-256:784FC9D9F071130803E34792755CA68B5D0CA3F509F265B109A533EBE0E5314A
                                                                                                                            SHA-512:CB7F47DE766ADD6FA3C37F738BB562B352CB7EF89EB637417FDDD8235D86C503D7037713B0B5AF0C82A6BF4EC816CDE28A90418DC7ECB1E731B64EEE839B8AE4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:0.(...*.H........(.0.(....1.0...+......0.....+.....7......0...0...+.....7.......A.n..K..VU..6C..070405015813Z0...+.....7.....0..L0....RE.8.6.C.F.5.3.0.F.E.0.0.C.0.F.A.2.A.1.0.7.6.8.4.A.1.9.8.B.3.7.E.9.7.B.9.C.E.7.6...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........l.0....*.v....~...v0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..&.RF.7.7.0.E.2.4.2.9.A.D.8.A.C.D.3.8.0.F.7.7.2.5.C.7.6.C.E.B.2.E.1.9.6.6.9.E.6.F.7...1..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+.........p.B....r\v..i......0..0,..+.....7.....0....S.p.L.e.v.e.l........0...0D..+.....7....604...S.p.A.t.t.r........2.0.0.5.0.2.0.1.0.0.0.0.0.0...0....+.....7....x0v...O.S.A.t.t.r.......`2.:.5...0.,.2.:.5...1.,.2.:.5...2.,.2.:.5...x.,.2.:.6...x.,.2.:.7...x.,.2.:.8...x.,.2.:.9...x..... .0...0..............

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\xinput1_3_x86.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):783
                                                                                                                            Entropy (8bit):5.506417721060717
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:tsXnoHKJhm+eajQ3YKVmHwXdwXqdRl2qGTF4ngflLgprCpt8e49pt8rsE7x16Zw:tsXnoqJhoajgjzdKqhnUMVI8h8rsE7xH
                                                                                                                            MD5:E16C94EDC4B577B7ABE7B06E31376884
                                                                                                                            SHA1:E86CF530FE00C0FA2A107684A198B37E97B9CE76
                                                                                                                            SHA-256:BA212AA1514DF6509474A46C7B2FA07C210D249B524BF7D47D058461009A75C1
                                                                                                                            SHA-512:5405F6936E05E1260A3778D86D76145D2853A345AFA156BA6E0A7CF4BC9267CD4CBB5CD32878ADDA3C6130721218FB899FC896BF823CD63C32C7086B18CFE9DB
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..[Version]..Signature = "$Windows NT$"..AdvancedINF = 2.0..Provider = %MSFT%..Class = %ExceptionClassDesc%..ClassGUID = {F5776D81-AE53-4935-8E84-B0B283D8BCEF}..CatalogFile = xinput1_3_x86.cat..ComponentId = {8B594EEF-4FAF-4C62-A647-04CA85E5AB00}..DriverVer = 04-04-2007, 5.3.1.0904....[SourceDisksNames]..99 = %DiskName%,"APR2007_xinput_x86.cab",0,,-1....[SourceDisksFiles]..xinput1_3.dll = 99....[DestinationDirs]..DirectX_System = 11..DirectX_SysWOW64 = 10,SysWOW64....[x86_Install]..CopyFiles = DirectX_System....[x64_Install]..CopyFiles = DirectX_SysWOW64....[DirectX_System]..xinput1_3.dll....[DirectX_SysWOW64]..xinput1_3.dll....[Strings]..MSFT = "Microsoft"..ExceptionClassDesc = "DirectX 9.0 APR2007"..DiskName = "DirectX 9.0 APR2007 cab"....

                                                                                                                            C:\Users\user\AppData\Local\Temp\DX49EC.tmp\xinput1_3_x86_xp.inf

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Windows setup INFormation
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):559
                                                                                                                            Entropy (8bit):5.278451695211352
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:tsXnoHqql2qGTF4ngflLgprCpt8e49pt8rsE7x16Zw:tsXnoKhqhnUMVI8h8rsE7xH
                                                                                                                            MD5:1B4A9360253BBBF4FF2DC1F8F3C0005C
                                                                                                                            SHA1:BC639A35D965C579A7DDA8D60748D7482F737F66
                                                                                                                            SHA-256:576AD2F8CC0F371D0E061F4A407153BD90E48841FCE7A8F7EF1FF3FDD4138C99
                                                                                                                            SHA-512:C0390CAB5DB06A5930EE563055C29EA10B6751049A77B33C9DD89F4016A3887D4D49670CF66D1F395EDC00A3E127864129EC57CBB4AF21B0D67ED6855950EDE3
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..[Version]..Signature = "$Windows NT$"..AdvancedINF = 2.0....[SourceDisksNames]..99 = %DiskName%,"APR2007_xinput_x86.cab",0,,-1....[SourceDisksFiles]..xinput1_3.dll = 99....[DestinationDirs]..DirectX_System = 11..DirectX_SysWOW64 = 10,SysWOW64....[x86_Install]..CopyFiles = DirectX_System....[x64_Install]..CopyFiles = DirectX_SysWOW64....[DirectX_System]..xinput1_3.dll....[DirectX_SysWOW64]..xinput1_3.dll....[Strings]..MSFT = "Microsoft"..ExceptionClassDesc = "DirectX 9.0 APR2007"..DiskName = "DirectX 9.0 APR2007 cab"....

                                                                                                                            C:\Users\user\AppData\Local\Temp\MSI2176.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):216496
                                                                                                                            Entropy (8bit):6.646208142644182
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
                                                                                                                            MD5:A3AE5D86ECF38DB9427359EA37A5F646
                                                                                                                            SHA1:EB4CB5FF520717038ADADCC5E1EF8F7C24B27A90
                                                                                                                            SHA-256:C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
                                                                                                                            SHA-512:96ECB3BC00848EEB2836E289EF7B7B2607D30790FFD1AE0E0ACFC2E14F26A991C6E728B8DC67280426E478C70231F9E13F514E52C8CE7D956C1FAD0E322D98E0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........................^.......\......].........................,.......<.........L...'.....'.....'.P.......8.....'.....Rich............................PE..L...Ap.]...........!.........P............................................................@.........................@................P..x....................`..........T...............................@...............<............................text...[........................... ..`.rdata..............................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\MSIE561.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):116144
                                                                                                                            Entropy (8bit):6.633672738599962
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:YImZwomOndvrhsgz56GoiFmntw1ebC0fsWk0FlcdOJKJpPpxyNokVbY4:jewOdvregz5L/mxb7FUOsrPpxyN7/
                                                                                                                            MD5:4FDD16752561CF585FED1506914D73E0
                                                                                                                            SHA1:F00023B9AE3C8CE5B7BB92F25011EAEBE6F9D424
                                                                                                                            SHA-256:AECD2D2FE766F6D439ACC2BBF1346930ECC535012CF5AD7B3273D2875237B7E7
                                                                                                                            SHA-512:3695E7EB1E35EC959243A91AB5B4454EB59AEEF0F2699AA5DE8E03DE8FBB89F756A89130526DA5C08815408CB700284A17936522AD2CAD594C3E6E9D18A3F600
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z.b...1...1...1/.^1...1/.\1...1/.]1...1.s.0...1.s.0...1.s.0...1.c<1...1...1^..1.r.0...1.r.0...1.rP1...1..81...1.r.0...1Rich...1........................PE..L....p.]...........!.................4....... ......................................Y.....@.........................p...\..............x...............................T...........................8...@............ ..(............................text...k........................... ..`.rdata...w... ...x..................@..@.data...<"..........................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\MSIE717.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):259950
                                                                                                                            Entropy (8bit):6.312075792225588
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:FArbg5BxgracGnEnRQOl9WGPotdix9uYuiARxs3J4VtiaGKykjFgESYj:FArbtraBqLlAGvPIs3qtiaCkjKESYj
                                                                                                                            MD5:F54843AF156794BA61AE0EC764251229
                                                                                                                            SHA1:069BA2232C67729A23841EC6C69021CE63B59A37
                                                                                                                            SHA-256:02A22318281D8F0475076239A63434189B142F2F533CA378D074AB9EB4E9CFDA
                                                                                                                            SHA-512:2D687454AEFCF93667B4D044092F549650C048E9311ED0A474F7E573F5BC8F9E3E18CECD00A69EB6F2FECEDAA23CC63AD882C193B310D52DBACC6E8049E7CE5C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................'P\....'P^....'P_...........................>.......4..................R......:...........Rich...........................PE..L....o.]...........!.....D...|.......L.......`.......................................@....@.........................0}...*......x...............................4... s..T...........................xs..@............`..l............................text....B.......D.................. ..`.rdata...Q...`...R...H..............@..@.data...p...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\MSIE717.tmp-\CustomAction.config

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1493
                                                                                                                            Entropy (8bit):4.732294656481805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:2dhmhx0PY6Iee7LfKhT06XWwlTh17jJBDZtG9jDqRp:c0nd5t7q7WwFD7t3tG96n
                                                                                                                            MD5:3A35350940B2FA2C5A9C57BDB25AAE3F
                                                                                                                            SHA1:F4D32D9E007478C80C23F7B70245D6401550CE6A
                                                                                                                            SHA-256:361F2F5623B1E11403827FFD625C9EDC5D7977D584393D6475FC5E6559C3EDB7
                                                                                                                            SHA-512:62756D9247CD6EAD152F00D5FF7627E3158E5F0BEAE00520510830EEB9B1FF5B3A33201BC81240BD31F066198C6B639E3F2CBCEB9155C2CE994900AB3A685E8B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies .. by using the lates

                                                                                                                            C:\Users\user\AppData\Local\Temp\MSIE717.tmp-\CustomActionManaged.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):36352
                                                                                                                            Entropy (8bit):4.813800140264642
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:v2b9NQxWU/kFDMgVzC2Yejxt2GlKyMmfSFtr5AEmHk4gQLnHMdbR:v2mHkDM32Bj2+KyWrB4gQzMd1
                                                                                                                            MD5:2B54558C365370886723974967A60B45
                                                                                                                            SHA1:FAF9BF7AC38BF35701DB8BD14321BA5E97A0103F
                                                                                                                            SHA-256:A7C459CA67D6388EB3C8D16A210E1DC73F6ABFFBB8A78BCF071C22F809942AFA
                                                                                                                            SHA-512:A47E0589FE690D45EEBDD540033FB1C0BEF88DBB6A9ED6FDDA0B989DEF4EBE5683A387CA2F72819727BA5BA372368BC35F76FC6BB32EF860F298FC13525BAB84
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....68e.........." ..0.................. ........... ....................................@....................................O.......d............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B........................H.......,>..he...........................................................0..0.........(......o......(....-........,..o.......&...*.*....................')......Z(.......(....+.......*..{....*"..}....*..{....*.0..........(......~....(....-..*....0..........~.....r...pr...p~....(....o......,..~....(....,;(.....r...pr...p..r...p(....(....r...pr...p~....(....o.......&...,..o....*r...p*........gm.......0..0.......~.....r...pr...p~....(....o.......&...,..*~....*.........".......0..

                                                                                                                            C:\Users\user\AppData\Local\Temp\MSIE717.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184240
                                                                                                                            Entropy (8bit):5.876033362692288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
                                                                                                                            MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
                                                                                                                            SHA1:F070AC0D91BD337D7952ABD1DDF19A737B94510C
                                                                                                                            SHA-256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
                                                                                                                            SHA-512:A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\MSIc7781.LOG

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe
                                                                                                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):460
                                                                                                                            Entropy (8bit):3.430378214427457
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:Qw5sOLqHA1FbdpYnbc6wmoUOM0L3qHnns:QksOOHWdabc6wmo20LaHns
                                                                                                                            MD5:19FE8F48FD20980295E7B5569F7257CE
                                                                                                                            SHA1:3045D1747E8B41DA096228E27CDA3386788FFB05
                                                                                                                            SHA-256:472E8C7F986B5B8683533A446AC6DA800BB5D2187EC501B0E4F82872CE3AB2DD
                                                                                                                            SHA-512:BFA9E46E72517CA829AE32EFA17B31B3A1D657FC893B7C0DE90475E3CB45F2F04422247BA0C4960B8F6712D3F2857B1BAAFECAB8BEA3A6B98C1DE1BF75EC2D5A
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:..E.r.r.o.r. .1.3.0.7... .T.h.e.r.e. .i.s. .n.o.t. .e.n.o.u.g.h. .d.i.s.k. .s.p.a.c.e. .t.o. .i.n.s.t.a.l.l. .t.h.i.s. .f.i.l.e.:. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.E.p.i.c. .G.a.m.e.s.\.E.p.i.c. .O.n.l.i.n.e. .S.e.r.v.i.c.e.s.\.C.E.F.\.W.i.n.3.2.\.R.e.s.o.u.r.c.e.s.\.c.h.r.o.m.e._.1.0.0._.p.e.r.c.e.n.t...p.a.k... . .F.r.e.e. .s.o.m.e. .d.i.s.k. .s.p.a.c.e. .a.n.d. .c.l.i.c.k. .R.e.t.r.y.,. .o.r. .c.l.i.c.k. .C.a.n.c.e.l. .t.o. .e.x.i.t.......

                                                                                                                            C:\Users\user\AppData\Local\Temp\~DF725A3D1567EE9D53.TMP

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):69632
                                                                                                                            Entropy (8bit):0.3596958350259261
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:TqnStXd9NdmaQSJ6AdMXdY9Zd5LdLf2ydekKQIAdjS9DBKNdmapaPjbP3Rs6g7Mn:eHg5nf2JlDTXZs6gwgfJD9Oe0F
                                                                                                                            MD5:75340C56114877883DD85556FCA4FCFC
                                                                                                                            SHA1:D857AC1CEFB07936245604ADE17D54DEB501F07F
                                                                                                                            SHA-256:B11B88B5F3232E33F93FA0CD7BBC9DD2CDB23A5527B318068FA53C8F2AEBAA46
                                                                                                                            SHA-512:58A12BEEB57B52C8D9EC691CE72C4D5D088789394DB0DD868B6F5C2D3FE59B33AA494A62E26B36E5A43799402BBB8F71E1E9513B71764641EC5461E45A3EF711
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\Desktop\cmdline.out

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:modified
                                                                                                                            Size (bytes):281397
                                                                                                                            Entropy (8bit):2.173148773463383
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:Ht+AEAGyP3DDnC0JW2CfAXDSuILI2TZypldqtGPpnnazGD/UL6am2uKKXWumeqnt:HkAE2HjvGenj1m3QSl5fiYIIHLL
                                                                                                                            MD5:F22C5515823BF5301F5D9050AE365B8C
                                                                                                                            SHA1:EF92B53ED5C8010808B37EC34994F27C5883AE36
                                                                                                                            SHA-256:158CDB1697DD171492F72CAD89B186BD74914554C425ADBBFE59374CD7FCB1E6
                                                                                                                            SHA-512:FB4A26618CCCD6D5116E494CA760CD1AB0DD20A22FD465BA885F52A54D1EDF80F519D85E32FADF40C5663718FF90D3F5E73158EA8079453D5B261482529B2DB8
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:--2023-10-31 12:02:02-- https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine..Resolving launcher-public-service-prod06.ol.epicgames.com (launcher-public-service-prod06.ol.epicgames.com)... 18.67.65.6, 18.67.65.94, 18.67.65.112, .....Connecting to launcher-public-service-prod06.ol.epicgames.com (launcher-public-service-prod06.ol.epicgames.com)|18.67.65.6|:443... connected...HTTP request sent, awaiting response... 303 See Other..Location: https://epicgames-download1.akamaized.net/Builds/UnrealEngineLauncher/Installers/Win32/EpicInstaller-15.17.1.msi?launcherfilename=EpicInstaller-15.17.1-unrealEngine.msi [following]..--2023-10-31 12:02:02-- https://epicgames-download1.akamaized.net/Builds/UnrealEngineLauncher/Installers/Win32/EpicInstaller-15.17.1.msi?launcherfilename=EpicInstaller-15.17.1-unrealEngine.msi..Resolving epicgames-download1.akamaized.net (epicgames-download1.akamaized.net)... 23.219.

                                                                                                                            C:\Users\user\Desktop\download\EpicInstaller-15.17.1-unrealEngine.msi

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\wget.exe
                                                                                                                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Epic Games Launcher, Author: Epic Games, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install Epic Games Launcher., Create Time/Date: Tue Oct 24 22:37:28 2023, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 4, Template: Intel;1033,1042,1041,2052,1025,1031,1034,1036,1040,1045,1046,1049,1055,1054,1028, Last Saved By: Intel;1033,1042,1041,2052,1025,1031,1034,1036,1040,1045,1046,1049,1055,1054,1028, Revision Number: {B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}1.3.93.0;{FEC1A84C-0BE3-4B1C-9F28-9E333C9DE22D}1.3.93.0;{D0769F44-D459-450F-B084-CAE38062C75B}, Number of Pages: 405, Number of Characters: 0
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):185073664
                                                                                                                            Entropy (8bit):7.997663391194621
                                                                                                                            Encrypted:true
                                                                                                                            SSDEEP:3145728:oyKHxXZR5bsPL+buxE4ynkX+kKbtt3V8mIeDLhZ8muXNNE7byK88OmTZbOW/rXiA:IP4PAwUnkuk8BNbLIxg7bUQ
                                                                                                                            MD5:7A2CF04AC0C504A8EA5AED805DDE484D
                                                                                                                            SHA1:0536D7A178D1A42CEA1476EA6B44BC53ED26BC63
                                                                                                                            SHA-256:6F3F486D7A8409FC174198818C039152C6268BD9FDF210EE6BE1C91BF832B7E9
                                                                                                                            SHA-512:42AEED1D015AB279DF3065E04ADFF8001672A13180F4D73121ACE3BC8989783F12C7A5D0B50C684C74FD138FC1B4F451439ACD7B6342D4F60C7D3A18034E0988
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:......................>...................-................................................................ ...$...(...,...0...4...8...<...@...D...H...L...P...T...X...\...`...d...h...l...p...t...x...|..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\5ad366.msi

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Epic Games Launcher, Author: Epic Games, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install Epic Games Launcher., Create Time/Date: Tue Oct 24 22:37:28 2023, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 4, Template: Intel;1033,1042,1041,2052,1025,1031,1034,1036,1040,1045,1046,1049,1055,1054,1028, Last Saved By: Intel;1033,1042,1041,2052,1025,1031,1034,1036,1040,1045,1046,1049,1055,1054,1028, Revision Number: {B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}1.3.93.0;{FEC1A84C-0BE3-4B1C-9F28-9E333C9DE22D}1.3.93.0;{D0769F44-D459-450F-B084-CAE38062C75B}, Number of Pages: 405, Number of Characters: 0
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):185073664
                                                                                                                            Entropy (8bit):7.997663391194621
                                                                                                                            Encrypted:true
                                                                                                                            SSDEEP:3145728:oyKHxXZR5bsPL+buxE4ynkX+kKbtt3V8mIeDLhZ8muXNNE7byK88OmTZbOW/rXiA:IP4PAwUnkuk8BNbLIxg7bUQ
                                                                                                                            MD5:7A2CF04AC0C504A8EA5AED805DDE484D
                                                                                                                            SHA1:0536D7A178D1A42CEA1476EA6B44BC53ED26BC63
                                                                                                                            SHA-256:6F3F486D7A8409FC174198818C039152C6268BD9FDF210EE6BE1C91BF832B7E9
                                                                                                                            SHA-512:42AEED1D015AB279DF3065E04ADFF8001672A13180F4D73121ACE3BC8989783F12C7A5D0B50C684C74FD138FC1B4F451439ACD7B6342D4F60C7D3A18034E0988
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:......................>...................-................................................................ ...$...(...,...0...4...8...<...@...D...H...L...P...T...X...\...`...d...h...l...p...t...x...|..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\5ad367.ipi

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24576
                                                                                                                            Entropy (8bit):1.974807518905605
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:96:xkQrqP8wfng5nf2JlDTXZs6gwgfJD9Oeo:xc7gJf2rL
                                                                                                                            MD5:76E7B2C7F6BC09E717A408540FC20BA2
                                                                                                                            SHA1:4903E134A7FCB3D4A24A84D96A303162D518F416
                                                                                                                            SHA-256:02FD3916D9ED418195A6D85B8103E4FD01B4622D0865C8A009B799E225942585
                                                                                                                            SHA-512:43BEE0502680E53DA82032AFEE7DF4212566FB2011F1AE162DAEF2B7372D7F7DCC03AA91CB5C1B0C15B019E236AC788811B328340AAD12934C6468FC1D60BCF4
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSI4E94.tmp-\CustomAction.config

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1493
                                                                                                                            Entropy (8bit):4.732294656481805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:2dhmhx0PY6Iee7LfKhT06XWwlTh17jJBDZtG9jDqRp:c0nd5t7q7WwFD7t3tG96n
                                                                                                                            MD5:3A35350940B2FA2C5A9C57BDB25AAE3F
                                                                                                                            SHA1:F4D32D9E007478C80C23F7B70245D6401550CE6A
                                                                                                                            SHA-256:361F2F5623B1E11403827FFD625C9EDC5D7977D584393D6475FC5E6559C3EDB7
                                                                                                                            SHA-512:62756D9247CD6EAD152F00D5FF7627E3158E5F0BEAE00520510830EEB9B1FF5B3A33201BC81240BD31F066198C6B639E3F2CBCEB9155C2CE994900AB3A685E8B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies .. by using the lates

                                                                                                                            C:\Windows\Installer\MSI4E94.tmp-\CustomActionManaged.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):36352
                                                                                                                            Entropy (8bit):4.813800140264642
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:v2b9NQxWU/kFDMgVzC2Yejxt2GlKyMmfSFtr5AEmHk4gQLnHMdbR:v2mHkDM32Bj2+KyWrB4gQzMd1
                                                                                                                            MD5:2B54558C365370886723974967A60B45
                                                                                                                            SHA1:FAF9BF7AC38BF35701DB8BD14321BA5E97A0103F
                                                                                                                            SHA-256:A7C459CA67D6388EB3C8D16A210E1DC73F6ABFFBB8A78BCF071C22F809942AFA
                                                                                                                            SHA-512:A47E0589FE690D45EEBDD540033FB1C0BEF88DBB6A9ED6FDDA0B989DEF4EBE5683A387CA2F72819727BA5BA372368BC35F76FC6BB32EF860F298FC13525BAB84
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....68e.........." ..0.................. ........... ....................................@....................................O.......d............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B........................H.......,>..he...........................................................0..0.........(......o......(....-........,..o.......&...*.*....................')......Z(.......(....+.......*..{....*"..}....*..{....*.0..........(......~....(....-..*....0..........~.....r...pr...p~....(....o......,..~....(....,;(.....r...pr...p..r...p(....(....r...pr...p~....(....o.......&...,..o....*r...p*........gm.......0..0.......~.....r...pr...p~....(....o.......&...,..*~....*.........".......0..

                                                                                                                            C:\Windows\Installer\MSI4E94.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184240
                                                                                                                            Entropy (8bit):5.876033362692288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
                                                                                                                            MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
                                                                                                                            SHA1:F070AC0D91BD337D7952ABD1DDF19A737B94510C
                                                                                                                            SHA-256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
                                                                                                                            SHA-512:A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSI7D38.tmp-\CustomAction.config

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1493
                                                                                                                            Entropy (8bit):4.732294656481805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:2dhmhx0PY6Iee7LfKhT06XWslTh17jJB7ZtG9jDqRp:c0nd5t7q7WsFD7tztG96n
                                                                                                                            MD5:01C01D040563A55E0FD31CC8DAA5F155
                                                                                                                            SHA1:3C1C229703198F9772D7721357F1B90281917842
                                                                                                                            SHA-256:33D947C04A10E3AFF3DCA3B779393FA56CE5F02251C8CBAE5076A125FDEA081F
                                                                                                                            SHA-512:9C3F0CC17868479575090E1949E31A688B8C1CDFA56AC4A08CBE661466BB40ECFC94EA512DC4B64D5FF14A563F96F1E71C03B6EEACC42992455BD4F1C91F17D5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies.. by using the latest

                                                                                                                            C:\Windows\Installer\MSI7D38.tmp-\CustomActionManaged.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):51200
                                                                                                                            Entropy (8bit):5.0659062068745335
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:9aob1Yt6/ibkVewbBUwBWnC0ee76rUYxv:/v/PlJWC9drUYxv
                                                                                                                            MD5:2CF9FE3247BB25DAF0AADDEFD6D40763
                                                                                                                            SHA1:DC9B4F8E2BB6E202500061E0E03DDDB102E42F26
                                                                                                                            SHA-256:DD24F8EF3EF4B6BC58B08ADE93E4AAC64856EE681909201B42CB0111A45FE9E6
                                                                                                                            SHA-512:4AF9A34082DD04179A080918C88FFFD2DDBC1D7E34779C50F8B9A2EEC9CFB65F2DE3EA016FA0843DE97DFEA5B0CA7E86F07EC0D7D1358DF6A3BCCB54C806A11C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}..d.........." ..0.............2.... ........... ....................... ............@.....................................O.......d............................................................................ ............... ..H............text...8.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B........................H.......<T..l............................................................0...........-.r...ps....z...u....,...+_.u0...,...+S.u1...-(.u2...- .u3...-..u4...-..u5...-..u6...,...+..u....,...+..u7...-..u8...,.......(....*.0..]........-.r...ps....z..(......sv......ox.....-...ou....o.....$..ou.....o.......,..o......,..o......*.........%."G..........4Q.......0..K........-.r...ps....z.sv......ow.....-....%..ou.....o........,..o......,..o......*..........5..........*?......&...(....*..

                                                                                                                            C:\Windows\Installer\MSI7D38.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184240
                                                                                                                            Entropy (8bit):5.876033362692288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
                                                                                                                            MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
                                                                                                                            SHA1:F070AC0D91BD337D7952ABD1DDF19A737B94510C
                                                                                                                            SHA-256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
                                                                                                                            SHA-512:A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSI7F99.tmp-\CustomAction.config

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1493
                                                                                                                            Entropy (8bit):4.732294656481805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:2dhmhx0PY6Iee7LfKhT06XWslTh17jJB7ZtG9jDqRp:c0nd5t7q7WsFD7tztG96n
                                                                                                                            MD5:01C01D040563A55E0FD31CC8DAA5F155
                                                                                                                            SHA1:3C1C229703198F9772D7721357F1B90281917842
                                                                                                                            SHA-256:33D947C04A10E3AFF3DCA3B779393FA56CE5F02251C8CBAE5076A125FDEA081F
                                                                                                                            SHA-512:9C3F0CC17868479575090E1949E31A688B8C1CDFA56AC4A08CBE661466BB40ECFC94EA512DC4B64D5FF14A563F96F1E71C03B6EEACC42992455BD4F1C91F17D5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies.. by using the latest

                                                                                                                            C:\Windows\Installer\MSI7F99.tmp-\CustomActionManaged.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):51200
                                                                                                                            Entropy (8bit):5.0659062068745335
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:9aob1Yt6/ibkVewbBUwBWnC0ee76rUYxv:/v/PlJWC9drUYxv
                                                                                                                            MD5:2CF9FE3247BB25DAF0AADDEFD6D40763
                                                                                                                            SHA1:DC9B4F8E2BB6E202500061E0E03DDDB102E42F26
                                                                                                                            SHA-256:DD24F8EF3EF4B6BC58B08ADE93E4AAC64856EE681909201B42CB0111A45FE9E6
                                                                                                                            SHA-512:4AF9A34082DD04179A080918C88FFFD2DDBC1D7E34779C50F8B9A2EEC9CFB65F2DE3EA016FA0843DE97DFEA5B0CA7E86F07EC0D7D1358DF6A3BCCB54C806A11C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}..d.........." ..0.............2.... ........... ....................... ............@.....................................O.......d............................................................................ ............... ..H............text...8.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B........................H.......<T..l............................................................0...........-.r...ps....z...u....,...+_.u0...,...+S.u1...-(.u2...- .u3...-..u4...-..u5...-..u6...,...+..u....,...+..u7...-..u8...,.......(....*.0..]........-.r...ps....z..(......sv......ox.....-...ou....o.....$..ou.....o.......,..o......,..o......*.........%."G..........4Q.......0..K........-.r...ps....z.sv......ow.....-....%..ou.....o........,..o......,..o......*..........5..........*?......&...(....*..

                                                                                                                            C:\Windows\Installer\MSI7F99.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184240
                                                                                                                            Entropy (8bit):5.876033362692288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
                                                                                                                            MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
                                                                                                                            SHA1:F070AC0D91BD337D7952ABD1DDF19A737B94510C
                                                                                                                            SHA-256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
                                                                                                                            SHA-512:A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSI822A.tmp-\CustomAction.config

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1493
                                                                                                                            Entropy (8bit):4.732294656481805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:2dhmhx0PY6Iee7LfKhT06XWslTh17jJB7ZtG9jDqRp:c0nd5t7q7WsFD7tztG96n
                                                                                                                            MD5:01C01D040563A55E0FD31CC8DAA5F155
                                                                                                                            SHA1:3C1C229703198F9772D7721357F1B90281917842
                                                                                                                            SHA-256:33D947C04A10E3AFF3DCA3B779393FA56CE5F02251C8CBAE5076A125FDEA081F
                                                                                                                            SHA-512:9C3F0CC17868479575090E1949E31A688B8C1CDFA56AC4A08CBE661466BB40ECFC94EA512DC4B64D5FF14A563F96F1E71C03B6EEACC42992455BD4F1C91F17D5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies.. by using the latest

                                                                                                                            C:\Windows\Installer\MSI822A.tmp-\CustomActionManaged.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):51200
                                                                                                                            Entropy (8bit):5.0659062068745335
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:9aob1Yt6/ibkVewbBUwBWnC0ee76rUYxv:/v/PlJWC9drUYxv
                                                                                                                            MD5:2CF9FE3247BB25DAF0AADDEFD6D40763
                                                                                                                            SHA1:DC9B4F8E2BB6E202500061E0E03DDDB102E42F26
                                                                                                                            SHA-256:DD24F8EF3EF4B6BC58B08ADE93E4AAC64856EE681909201B42CB0111A45FE9E6
                                                                                                                            SHA-512:4AF9A34082DD04179A080918C88FFFD2DDBC1D7E34779C50F8B9A2EEC9CFB65F2DE3EA016FA0843DE97DFEA5B0CA7E86F07EC0D7D1358DF6A3BCCB54C806A11C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}..d.........." ..0.............2.... ........... ....................... ............@.....................................O.......d............................................................................ ............... ..H............text...8.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B........................H.......<T..l............................................................0...........-.r...ps....z...u....,...+_.u0...,...+S.u1...-(.u2...- .u3...-..u4...-..u5...-..u6...,...+..u....,...+..u7...-..u8...,.......(....*.0..]........-.r...ps....z..(......sv......ox.....-...ou....o.....$..ou.....o.......,..o......,..o......*.........%."G..........4Q.......0..K........-.r...ps....z.sv......ow.....-....%..ou.....o........,..o......,..o......*..........5..........*?......&...(....*..

                                                                                                                            C:\Windows\Installer\MSI822A.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184240
                                                                                                                            Entropy (8bit):5.876033362692288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
                                                                                                                            MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
                                                                                                                            SHA1:F070AC0D91BD337D7952ABD1DDF19A737B94510C
                                                                                                                            SHA-256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
                                                                                                                            SHA-512:A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSI8AE2.tmp-\CustomAction.config

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1493
                                                                                                                            Entropy (8bit):4.732294656481805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:2dhmhx0PY6Iee7LfKhT06XWslTh17jJB7ZtG9jDqRp:c0nd5t7q7WsFD7tztG96n
                                                                                                                            MD5:01C01D040563A55E0FD31CC8DAA5F155
                                                                                                                            SHA1:3C1C229703198F9772D7721357F1B90281917842
                                                                                                                            SHA-256:33D947C04A10E3AFF3DCA3B779393FA56CE5F02251C8CBAE5076A125FDEA081F
                                                                                                                            SHA-512:9C3F0CC17868479575090E1949E31A688B8C1CDFA56AC4A08CBE661466BB40ECFC94EA512DC4B64D5FF14A563F96F1E71C03B6EEACC42992455BD4F1C91F17D5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies.. by using the latest

                                                                                                                            C:\Windows\Installer\MSI8AE2.tmp-\CustomActionManaged.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):51200
                                                                                                                            Entropy (8bit):5.0659062068745335
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:9aob1Yt6/ibkVewbBUwBWnC0ee76rUYxv:/v/PlJWC9drUYxv
                                                                                                                            MD5:2CF9FE3247BB25DAF0AADDEFD6D40763
                                                                                                                            SHA1:DC9B4F8E2BB6E202500061E0E03DDDB102E42F26
                                                                                                                            SHA-256:DD24F8EF3EF4B6BC58B08ADE93E4AAC64856EE681909201B42CB0111A45FE9E6
                                                                                                                            SHA-512:4AF9A34082DD04179A080918C88FFFD2DDBC1D7E34779C50F8B9A2EEC9CFB65F2DE3EA016FA0843DE97DFEA5B0CA7E86F07EC0D7D1358DF6A3BCCB54C806A11C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}..d.........." ..0.............2.... ........... ....................... ............@.....................................O.......d............................................................................ ............... ..H............text...8.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B........................H.......<T..l............................................................0...........-.r...ps....z...u....,...+_.u0...,...+S.u1...-(.u2...- .u3...-..u4...-..u5...-..u6...,...+..u....,...+..u7...-..u8...,.......(....*.0..]........-.r...ps....z..(......sv......ox.....-...ou....o.....$..ou.....o.......,..o......,..o......*.........%."G..........4Q.......0..K........-.r...ps....z.sv......ow.....-....%..ou.....o........,..o......,..o......*..........5..........*?......&...(....*..

                                                                                                                            C:\Windows\Installer\MSI8AE2.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184240
                                                                                                                            Entropy (8bit):5.876033362692288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
                                                                                                                            MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
                                                                                                                            SHA1:F070AC0D91BD337D7952ABD1DDF19A737B94510C
                                                                                                                            SHA-256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
                                                                                                                            SHA-512:A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSI9171.tmp-\CustomAction.config

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1493
                                                                                                                            Entropy (8bit):4.732294656481805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:2dhmhx0PY6Iee7LfKhT06XWwlTh17jJBDZtG9jDqRp:c0nd5t7q7WwFD7t3tG96n
                                                                                                                            MD5:3A35350940B2FA2C5A9C57BDB25AAE3F
                                                                                                                            SHA1:F4D32D9E007478C80C23F7B70245D6401550CE6A
                                                                                                                            SHA-256:361F2F5623B1E11403827FFD625C9EDC5D7977D584393D6475FC5E6559C3EDB7
                                                                                                                            SHA-512:62756D9247CD6EAD152F00D5FF7627E3158E5F0BEAE00520510830EEB9B1FF5B3A33201BC81240BD31F066198C6B639E3F2CBCEB9155C2CE994900AB3A685E8B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies .. by using the lates

                                                                                                                            C:\Windows\Installer\MSI9171.tmp-\CustomActionManaged.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):36352
                                                                                                                            Entropy (8bit):4.813800140264642
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:v2b9NQxWU/kFDMgVzC2Yejxt2GlKyMmfSFtr5AEmHk4gQLnHMdbR:v2mHkDM32Bj2+KyWrB4gQzMd1
                                                                                                                            MD5:2B54558C365370886723974967A60B45
                                                                                                                            SHA1:FAF9BF7AC38BF35701DB8BD14321BA5E97A0103F
                                                                                                                            SHA-256:A7C459CA67D6388EB3C8D16A210E1DC73F6ABFFBB8A78BCF071C22F809942AFA
                                                                                                                            SHA-512:A47E0589FE690D45EEBDD540033FB1C0BEF88DBB6A9ED6FDDA0B989DEF4EBE5683A387CA2F72819727BA5BA372368BC35F76FC6BB32EF860F298FC13525BAB84
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....68e.........." ..0.................. ........... ....................................@....................................O.......d............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B........................H.......,>..he...........................................................0..0.........(......o......(....-........,..o.......&...*.*....................')......Z(.......(....+.......*..{....*"..}....*..{....*.0..........(......~....(....-..*....0..........~.....r...pr...p~....(....o......,..~....(....,;(.....r...pr...p..r...p(....(....r...pr...p~....(....o.......&...,..o....*r...p*........gm.......0..0.......~.....r...pr...p~....(....o.......&...,..*~....*.........".......0..

                                                                                                                            C:\Windows\Installer\MSI9171.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184240
                                                                                                                            Entropy (8bit):5.876033362692288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
                                                                                                                            MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
                                                                                                                            SHA1:F070AC0D91BD337D7952ABD1DDF19A737B94510C
                                                                                                                            SHA-256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
                                                                                                                            SHA-512:A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSI9A4F.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):259950
                                                                                                                            Entropy (8bit):6.312075792225588
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:FArbg5BxgracGnEnRQOl9WGPotdix9uYuiARxs3J4VtiaGKykjFgESYj:FArbtraBqLlAGvPIs3qtiaCkjKESYj
                                                                                                                            MD5:F54843AF156794BA61AE0EC764251229
                                                                                                                            SHA1:069BA2232C67729A23841EC6C69021CE63B59A37
                                                                                                                            SHA-256:02A22318281D8F0475076239A63434189B142F2F533CA378D074AB9EB4E9CFDA
                                                                                                                            SHA-512:2D687454AEFCF93667B4D044092F549650C048E9311ED0A474F7E573F5BC8F9E3E18CECD00A69EB6F2FECEDAA23CC63AD882C193B310D52DBACC6E8049E7CE5C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................'P\....'P^....'P_...........................>.......4..................R......:...........Rich...........................PE..L....o.]...........!.....D...|.......L.......`.......................................@....@.........................0}...*......x...............................4... s..T...........................xs..@............`..l............................text....B.......D.................. ..`.rdata...Q...`...R...H..............@..@.data...p...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSI9A4F.tmp-\CustomAction.config

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1493
                                                                                                                            Entropy (8bit):4.732294656481805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:2dhmhx0PY6Iee7LfKhT06XWwlTh17jJBDZtG9jDqRp:c0nd5t7q7WwFD7t3tG96n
                                                                                                                            MD5:3A35350940B2FA2C5A9C57BDB25AAE3F
                                                                                                                            SHA1:F4D32D9E007478C80C23F7B70245D6401550CE6A
                                                                                                                            SHA-256:361F2F5623B1E11403827FFD625C9EDC5D7977D584393D6475FC5E6559C3EDB7
                                                                                                                            SHA-512:62756D9247CD6EAD152F00D5FF7627E3158E5F0BEAE00520510830EEB9B1FF5B3A33201BC81240BD31F066198C6B639E3F2CBCEB9155C2CE994900AB3A685E8B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies .. by using the lates

                                                                                                                            C:\Windows\Installer\MSI9A4F.tmp-\CustomActionManaged.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):36352
                                                                                                                            Entropy (8bit):4.813800140264642
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:v2b9NQxWU/kFDMgVzC2Yejxt2GlKyMmfSFtr5AEmHk4gQLnHMdbR:v2mHkDM32Bj2+KyWrB4gQzMd1
                                                                                                                            MD5:2B54558C365370886723974967A60B45
                                                                                                                            SHA1:FAF9BF7AC38BF35701DB8BD14321BA5E97A0103F
                                                                                                                            SHA-256:A7C459CA67D6388EB3C8D16A210E1DC73F6ABFFBB8A78BCF071C22F809942AFA
                                                                                                                            SHA-512:A47E0589FE690D45EEBDD540033FB1C0BEF88DBB6A9ED6FDDA0B989DEF4EBE5683A387CA2F72819727BA5BA372368BC35F76FC6BB32EF860F298FC13525BAB84
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....68e.........." ..0.................. ........... ....................................@....................................O.......d............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B........................H.......,>..he...........................................................0..0.........(......o......(....-........,..o.......&...*.*....................')......Z(.......(....+.......*..{....*"..}....*..{....*.0..........(......~....(....-..*....0..........~.....r...pr...p~....(....o......,..~....(....,;(.....r...pr...p..r...p(....(....r...pr...p~....(....o.......&...,..o....*r...p*........gm.......0..0.......~.....r...pr...p~....(....o.......&...,..*~....*.........".......0..

                                                                                                                            C:\Windows\Installer\MSI9A4F.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184240
                                                                                                                            Entropy (8bit):5.876033362692288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
                                                                                                                            MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
                                                                                                                            SHA1:F070AC0D91BD337D7952ABD1DDF19A737B94510C
                                                                                                                            SHA-256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
                                                                                                                            SHA-512:A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSIA538.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:data
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2861789
                                                                                                                            Entropy (8bit):6.1691337180738355
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24576:log5kZwu04asB56BbMoKvEGJtaMRtlHzOE2Z34K/zOE2Z34Kb:lv2T6Bb6EWtNnUIynUI6
                                                                                                                            MD5:E5B747ACBB8FCC7696A3DCABA5195C0F
                                                                                                                            SHA1:D7AC8ECFB6FCD7106780F17E6A182F9DEAA0E011
                                                                                                                            SHA-256:31E268B3AA3BFD60F2F83403CBA4D381A4E17E773FEEE79A1B4D290E8CC3263F
                                                                                                                            SHA-512:321665E80E5CFC2E0E456BC23E912CBC3EAB51C101A43A908BA66FB7EAE72371B09759C60903DAE1F693A378BF91A43F0E93E8AC528BDA5B5A615C607D3AA4D5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:...@IXOS.@.....@.a_W.@.....@.....@.....@.....@.....@......&.{B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}..Epic Games Launcher&.EpicInstaller-15.17.1-unrealEngine.msi.@.....@]....@.....@......Installer.ico..&.{A13B70BC-1756-496B-B59D-57ABAB414A7D}.....@.....@.....@.....@.......@.....@.....@.......@......Epic Games Launcher......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{0A1854C3-A103-4EB9-AEFF-23E9388B9BA4}/.02:\Software\EpicGames\Unreal Engine\INSTALLDIR.@.......@.....@.....@......&.{50381214-3C27-4EA2-9681-8D3B63ADCF11}D.01:\Software\Epic Games\EpicGamesLauncher\StartMenuShortcutInstalled.@.......@.....@.....@......&.{14FC0C7C-7052-4099-8639-D521EF685E17}B.01:\Software\Epic Games\EpicGamesLauncher\DesktopShortcutInstalled.@.......@.....@.....@......&.{15FF6EE8-2A78-4FD0-830D-1A000D175ACF};.C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe.@.....

                                                                                                                            C:\Windows\Installer\MSIA826.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):259950
                                                                                                                            Entropy (8bit):6.312075792225588
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:FArbg5BxgracGnEnRQOl9WGPotdix9uYuiARxs3J4VtiaGKykjFgESYj:FArbtraBqLlAGvPIs3qtiaCkjKESYj
                                                                                                                            MD5:F54843AF156794BA61AE0EC764251229
                                                                                                                            SHA1:069BA2232C67729A23841EC6C69021CE63B59A37
                                                                                                                            SHA-256:02A22318281D8F0475076239A63434189B142F2F533CA378D074AB9EB4E9CFDA
                                                                                                                            SHA-512:2D687454AEFCF93667B4D044092F549650C048E9311ED0A474F7E573F5BC8F9E3E18CECD00A69EB6F2FECEDAA23CC63AD882C193B310D52DBACC6E8049E7CE5C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................'P\....'P^....'P_...........................>.......4..................R......:...........Rich...........................PE..L....o.]...........!.....D...|.......L.......`.......................................@....@.........................0}...*......x...............................4... s..T...........................xs..@............`..l............................text....B.......D.................. ..`.rdata...Q...`...R...H..............@..@.data...p...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSIA826.tmp-\CustomAction.config

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1493
                                                                                                                            Entropy (8bit):4.732294656481805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:2dhmhx0PY6Iee7LfKhT06XWwlTh17jJBDZtG9jDqRp:c0nd5t7q7WwFD7t3tG96n
                                                                                                                            MD5:3A35350940B2FA2C5A9C57BDB25AAE3F
                                                                                                                            SHA1:F4D32D9E007478C80C23F7B70245D6401550CE6A
                                                                                                                            SHA-256:361F2F5623B1E11403827FFD625C9EDC5D7977D584393D6475FC5E6559C3EDB7
                                                                                                                            SHA-512:62756D9247CD6EAD152F00D5FF7627E3158E5F0BEAE00520510830EEB9B1FF5B3A33201BC81240BD31F066198C6B639E3F2CBCEB9155C2CE994900AB3A685E8B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies .. by using the lates

                                                                                                                            C:\Windows\Installer\MSIA826.tmp-\CustomActionManaged.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):36352
                                                                                                                            Entropy (8bit):4.813800140264642
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:v2b9NQxWU/kFDMgVzC2Yejxt2GlKyMmfSFtr5AEmHk4gQLnHMdbR:v2mHkDM32Bj2+KyWrB4gQzMd1
                                                                                                                            MD5:2B54558C365370886723974967A60B45
                                                                                                                            SHA1:FAF9BF7AC38BF35701DB8BD14321BA5E97A0103F
                                                                                                                            SHA-256:A7C459CA67D6388EB3C8D16A210E1DC73F6ABFFBB8A78BCF071C22F809942AFA
                                                                                                                            SHA-512:A47E0589FE690D45EEBDD540033FB1C0BEF88DBB6A9ED6FDDA0B989DEF4EBE5683A387CA2F72819727BA5BA372368BC35F76FC6BB32EF860F298FC13525BAB84
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....68e.........." ..0.................. ........... ....................................@....................................O.......d............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B........................H.......,>..he...........................................................0..0.........(......o......(....-........,..o.......&...*.*....................')......Z(.......(....+.......*..{....*"..}....*..{....*.0..........(......~....(....-..*....0..........~.....r...pr...p~....(....o......,..~....(....,;(.....r...pr...p..r...p(....(....r...pr...p~....(....o.......&...,..o....*r...p*........gm.......0..0.......~.....r...pr...p~....(....o.......&...,..*~....*.........".......0..

                                                                                                                            C:\Windows\Installer\MSIA826.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184240
                                                                                                                            Entropy (8bit):5.876033362692288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
                                                                                                                            MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
                                                                                                                            SHA1:F070AC0D91BD337D7952ABD1DDF19A737B94510C
                                                                                                                            SHA-256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
                                                                                                                            SHA-512:A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSIA8D2.tmp-\CustomAction.config

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1493
                                                                                                                            Entropy (8bit):4.732294656481805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:2dhmhx0PY6Iee7LfKhT06XWslTh17jJB7ZtG9jDqRp:c0nd5t7q7WsFD7tztG96n
                                                                                                                            MD5:01C01D040563A55E0FD31CC8DAA5F155
                                                                                                                            SHA1:3C1C229703198F9772D7721357F1B90281917842
                                                                                                                            SHA-256:33D947C04A10E3AFF3DCA3B779393FA56CE5F02251C8CBAE5076A125FDEA081F
                                                                                                                            SHA-512:9C3F0CC17868479575090E1949E31A688B8C1CDFA56AC4A08CBE661466BB40ECFC94EA512DC4B64D5FF14A563F96F1E71C03B6EEACC42992455BD4F1C91F17D5
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies.. by using the latest

                                                                                                                            C:\Windows\Installer\MSIA8D2.tmp-\CustomActionManaged.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):51200
                                                                                                                            Entropy (8bit):5.0659062068745335
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:9aob1Yt6/ibkVewbBUwBWnC0ee76rUYxv:/v/PlJWC9drUYxv
                                                                                                                            MD5:2CF9FE3247BB25DAF0AADDEFD6D40763
                                                                                                                            SHA1:DC9B4F8E2BB6E202500061E0E03DDDB102E42F26
                                                                                                                            SHA-256:DD24F8EF3EF4B6BC58B08ADE93E4AAC64856EE681909201B42CB0111A45FE9E6
                                                                                                                            SHA-512:4AF9A34082DD04179A080918C88FFFD2DDBC1D7E34779C50F8B9A2EEC9CFB65F2DE3EA016FA0843DE97DFEA5B0CA7E86F07EC0D7D1358DF6A3BCCB54C806A11C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}..d.........." ..0.............2.... ........... ....................... ............@.....................................O.......d............................................................................ ............... ..H............text...8.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B........................H.......<T..l............................................................0...........-.r...ps....z...u....,...+_.u0...,...+S.u1...-(.u2...- .u3...-..u4...-..u5...-..u6...,...+..u....,...+..u7...-..u8...,.......(....*.0..]........-.r...ps....z..(......sv......ox.....-...ou....o.....$..ou.....o.......,..o......,..o......*.........%."G..........4Q.......0..K........-.r...ps....z.sv......ow.....-....%..ou.....o........,..o......,..o......*..........5..........*?......&...(....*..

                                                                                                                            C:\Windows\Installer\MSIA8D2.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184240
                                                                                                                            Entropy (8bit):5.876033362692288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
                                                                                                                            MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
                                                                                                                            SHA1:F070AC0D91BD337D7952ABD1DDF19A737B94510C
                                                                                                                            SHA-256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
                                                                                                                            SHA-512:A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSIBB25.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):216496
                                                                                                                            Entropy (8bit):6.646208142644182
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
                                                                                                                            MD5:A3AE5D86ECF38DB9427359EA37A5F646
                                                                                                                            SHA1:EB4CB5FF520717038ADADCC5E1EF8F7C24B27A90
                                                                                                                            SHA-256:C8D190D5BE1EFD2D52F72A72AE9DFA3940AB3FACEB626405959349654FE18B74
                                                                                                                            SHA-512:96ECB3BC00848EEB2836E289EF7B7B2607D30790FFD1AE0E0ACFC2E14F26A991C6E728B8DC67280426E478C70231F9E13F514E52C8CE7D956C1FAD0E322D98E0
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........................^.......\......].........................,.......<.........L...'.....'.....'.P.......8.....'.....Rich............................PE..L...Ap.]...........!.........P............................................................@.........................@................P..x....................`..........T...............................@...............<............................text...[........................... ..`.rdata..............................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSIBBA3.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):259950
                                                                                                                            Entropy (8bit):6.312075792225588
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:FArbg5BxgracGnEnRQOl9WGPotdix9uYuiARxs3J4VtiaGKykjFgESYj:FArbtraBqLlAGvPIs3qtiaCkjKESYj
                                                                                                                            MD5:F54843AF156794BA61AE0EC764251229
                                                                                                                            SHA1:069BA2232C67729A23841EC6C69021CE63B59A37
                                                                                                                            SHA-256:02A22318281D8F0475076239A63434189B142F2F533CA378D074AB9EB4E9CFDA
                                                                                                                            SHA-512:2D687454AEFCF93667B4D044092F549650C048E9311ED0A474F7E573F5BC8F9E3E18CECD00A69EB6F2FECEDAA23CC63AD882C193B310D52DBACC6E8049E7CE5C
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................'P\....'P^....'P_...........................>.......4..................R......:...........Rich...........................PE..L....o.]...........!.....D...|.......L.......`.......................................@....@.........................0}...*......x...............................4... s..T...........................xs..@............`..l............................text....B.......D.................. ..`.rdata...Q...`...R...H..............@..@.data...p...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Installer\MSIBBA3.tmp-\CustomAction.config

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1493
                                                                                                                            Entropy (8bit):4.732294656481805
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:2dhmhx0PY6Iee7LfKhT06XWwlTh17jJBDZtG9jDqRp:c0nd5t7q7WwFD7t3tG96n
                                                                                                                            MD5:3A35350940B2FA2C5A9C57BDB25AAE3F
                                                                                                                            SHA1:F4D32D9E007478C80C23F7B70245D6401550CE6A
                                                                                                                            SHA-256:361F2F5623B1E11403827FFD625C9EDC5D7977D584393D6475FC5E6559C3EDB7
                                                                                                                            SHA-512:62756D9247CD6EAD152F00D5FF7627E3158E5F0BEAE00520510830EEB9B1FF5B3A33201BC81240BD31F066198C6B639E3F2CBCEB9155C2CE994900AB3A685E8B
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.... .. Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that.. the custom action should run on. If no versions are specified, the chosen version of the runtime.. will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against..... WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility.. problems with future versions of the .NET Framework runtime. It is highly recommended that you specify.. only the version(s) of the .NET Framework runtime that you have tested against..... Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0..... In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies .. by using the lates

                                                                                                                            C:\Windows\Installer\MSIBBA3.tmp-\CustomActionManaged.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):36352
                                                                                                                            Entropy (8bit):4.813800140264642
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:v2b9NQxWU/kFDMgVzC2Yejxt2GlKyMmfSFtr5AEmHk4gQLnHMdbR:v2mHkDM32Bj2+KyWrB4gQzMd1
                                                                                                                            MD5:2B54558C365370886723974967A60B45
                                                                                                                            SHA1:FAF9BF7AC38BF35701DB8BD14321BA5E97A0103F
                                                                                                                            SHA-256:A7C459CA67D6388EB3C8D16A210E1DC73F6ABFFBB8A78BCF071C22F809942AFA
                                                                                                                            SHA-512:A47E0589FE690D45EEBDD540033FB1C0BEF88DBB6A9ED6FDDA0B989DEF4EBE5683A387CA2F72819727BA5BA372368BC35F76FC6BB32EF860F298FC13525BAB84
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....68e.........." ..0.................. ........... ....................................@....................................O.......d............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc...d...........................@..@.reloc..............................@..B........................H.......,>..he...........................................................0..0.........(......o......(....-........,..o.......&...*.*....................')......Z(.......(....+.......*..{....*"..}....*..{....*.0..........(......~....(....-..*....0..........~.....r...pr...p~....(....o......,..~....(....,;(.....r...pr...p..r...p(....(....r...pr...p~....(....o.......&...,..o....*r...p*........gm.......0..0.......~.....r...pr...p~....(....o.......&...,..*~....*.........".......0..

                                                                                                                            C:\Windows\Installer\MSIBBA3.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):184240
                                                                                                                            Entropy (8bit):5.876033362692288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
                                                                                                                            MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
                                                                                                                            SHA1:F070AC0D91BD337D7952ABD1DDF19A737B94510C
                                                                                                                            SHA-256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
                                                                                                                            SHA-512:A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\Logs\DirectX.log

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):38715
                                                                                                                            Entropy (8bit):5.216581774279063
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:TboP/ExWDW7WDW4AWDW4AWDWLWDWfWDWhFWDWhpWDWhWDWtWDWYWDWIWDWcWDW00:TMtqhdO
                                                                                                                            MD5:D71361D2BAA516DAC45B012153263C97
                                                                                                                            SHA1:CB19B8F6C8034A6DD4BBB8F14C94460B678F4CBC
                                                                                                                            SHA-256:370940AAA7F6BEF8A3C2C0AB67C4D4E73140CAC0F221B41C1D2DB95C54B00DE6
                                                                                                                            SHA-512:C2EAA94C1489A24B84BE6F46B0100C5DAA679EFC95577F85A873187B7A6E1E37029335DFE64DB9DF2235DA2588F182D5CECC35065C9D0D0B481020D9D521EB5F
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:10/31/23 12:03:39: DXSetup: CommandLine: /silent..10/31/23 12:03:39: DSETUP: DirectXSetupA(): hWnd: 00000000 dwFlags: 02010098........10/31/23 12:03:39: dsetup32: === SetupForDirectX() start ===..10/31/23 12:03:39: dsetup32: Mar 30 2011 04:38:03..10/31/23 12:03:39: dsetup32: DXSetupCommand = 0...10/31/23 12:03:39: dsetup32: Installing on Windows 6.1.7601..10/31/23 12:03:39: dsetup32: DirectXSetupIsJapanese == 0..10/31/23 12:03:39: dsetup32: DirectXSetupIsJapanNec == 0..10/31/23 12:05:48: dsetup32: IsIA64(): not IA64...10/31/23 12:05:48: dsetup32: CLR version number = 2.0.50727....10/31/23 12:05:48: dsetup32: CLR version number = 4.0.30319....10/31/23 12:06:48: dsetup32: DXCheckTrust(): C:\PROGRA~2\EPICGA~1\DIRECT~1\dxupdate.cab is trusted...10/31/23 12:06:48: dsetup32: GetCDXUpdate(): Extracting dxupdate.dll from C:\PROGRA~2\EPICGA~1\DIRECT~1\dxupdate.cab...10/31/23 12:06:48: dsetup32: Extracted file C:\Users\user\AppData\Local\Temp\DX49EC.tmp\dxupdate.dll from cab..10/31/23 12:06:48:

                                                                                                                            C:\Windows\SysWOW64\SET4357.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):81768
                                                                                                                            Entropy (8bit):6.4167890753768395
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:TVeqvNS6T6jxeEsU6b0xZtDDVb9X8u9JA7zitdrz/R8cy/FaeBD:TVeqvNOeFgxZ9DVVtRBy/EeD
                                                                                                                            MD5:77F595DEE5FFACEA72B135B1FCE1312E
                                                                                                                            SHA1:D2A710B332DE3EF7A576E0AED27B0AE66892B7E9
                                                                                                                            SHA-256:8D540D484EA41E374FD0107D55D253F87DED4CE780D515D8FD59BBE8C98970A7
                                                                                                                            SHA-512:A8683050D7758C248052C11AC6A46C9A0B3B3773902CCA478C1961B6D9D2D57C75A8C925BA5AF4499989C0F44B34EAF57ABAFAFA26506C31E5E4769FB3439746
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M..i#Y.i#Y.i#Y.i"Y.i#Y.f~Y.i#Y.f,Y.i#Y.f|Y.i#Y.f.Y.i#Y.fCY.i#Y.f}Y.i#Y.fyY.i#YRich.i#Y........................PE..L...5S.F...........!.........F....................@..........................`..................................................d....0..................h%...@..8....................................&..@...............\............................text...j........................... ..`.data....+..........................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\SysWOW64\SET4471.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):470880
                                                                                                                            Entropy (8bit):6.715347536118646
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12288:cFUDOgwNvArf8r3bK9s3kW3CG3vQ3sad/QNbubxu:5DOgw6fYbK9s3kW3CG3vQ3snputu
                                                                                                                            MD5:20C835843FCEC4DEDFCD7BFFA3B91641
                                                                                                                            SHA1:5DD1D5B42A0B58D708D112694394A9A23691C283
                                                                                                                            SHA-256:56FCD13650FD1F075743154E8C48465DD68A236AB8960667D75373139D2631BF
                                                                                                                            SHA-512:561EB2BB3A7E562BAB0DE6372E824F65B310D96D840CDAA3C391969018AF6AFBA225665D07139FC938DCFF03F4F8DAE7F19DE61C9A0EAE7C658A32800DC9D123
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o..?+.nl+.nl+.nl+.ol..nl...l .nl...lk.nl...l$.nl...l*.nl...l{.nl.S.l*.nl...l*.nl...l*.nlRich+.nl........PE..L..../.K...........!.................9.......................................@...........@..........................v..%....k..x.......................`........0.....................................@............................................text....~.......................... ..`.data....].......V..................@....rsrc...............................@..@.reloc...9.......:..................@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\SysWOW64\SET45E9.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):248672
                                                                                                                            Entropy (8bit):6.540646534165038
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6144:8K0GaAtQlDJCSB4MvfIeDRI9Z7IJItblSwJ7FnH4fa1wlMjb5:eGjQlDkSB4MvfIeDRI9Z7IJIRlfJ7N4w
                                                                                                                            MD5:8E0BB968FF41D80E5F2C747C04DB79AE
                                                                                                                            SHA1:69B332D78020177A9B3F60CB672EC47578003C0D
                                                                                                                            SHA-256:492E960CB3CCFC8C25FC83F7C464BA77C86A20411347A1A9B3E5D3E8C9180A8D
                                                                                                                            SHA-512:7D71CB5411F239696E77FE57A272C675FE15D32456CE7BEFB0C2CF3FC567DCE5D38A45F4B004577E3DEC283904F42AE17A290105D8AB8EF6B70BAD4E15C9D506
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.c.0..Z0..Z0..Z.Z9..Z0..Z...Z.Z9..Z.Zp..Z.Z1..Z.Z...Z.6sZ1..Z.Z1..Z.Z1..ZRich0..Z........PE..L....1.K...........!.....6...|......F........P............................................@..........................<..E...T5..d.......................`.......`...................................`...@...............P............................text...%4.......6.................. ..`.data....S...P...R...:..............@....rsrc...............................@..@.reloc...".......$..................@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\SysWOW64\SET4760.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1868128
                                                                                                                            Entropy (8bit):6.25014757191993
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24576:/j0ZXvi+of1/z+uQ5Da3Qx1fF4dEQMtqVC43ux:/A9i/f1/z+Zce4dpMATe
                                                                                                                            MD5:83EBA442F07AAB8D6375D2EEC945C46C
                                                                                                                            SHA1:C29C20DA6BB30BE7D9DDA40241CA48F069123BD9
                                                                                                                            SHA-256:B46A44B6FCE8F141C9E02798645DB2EE0DA5C69EA71195E29F83A91A355FA2CA
                                                                                                                            SHA-512:288906C8AA8EB4D62440FE84DEAA25E7F362DC3644DAFC1227E45A71F6D915ACF885314531DB4757A9BF2E6CB12EAF43B54E9FF0F6A7E3239CABB697B07C25EA
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...E...E...E....$..E...E..]E....&..E.......E....!..E.......E......E.... ..E....'..E..Rich.E..........................PE..L....1.K...........!.........f......Mf....... ............................................@.........................0...X.......<....`...............j..`....p......P................................d..@............... ............................text............................... ..`.data....3... ...0..................@....rsrc........`.......8..............@..@.reloc...,...p.......<..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\SysWOW64\SET48E7.tmp

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):2106216
                                                                                                                            Entropy (8bit):6.4563314852745375
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
                                                                                                                            MD5:1C9B45E87528B8BB8CFA884EA0099A85
                                                                                                                            SHA1:98BE17E1D324790A5B206E1EA1CC4E64FBE21240
                                                                                                                            SHA-256:2F23182EC6F4889397AC4BF03D62536136C5BDBA825C7D2C4EF08C827F3A8A1C
                                                                                                                            SHA-512:B76D780810E8617B80331B4AD56E9C753652AF2E55B66795F7A7D67D6AFCEC5EF00D120D9B2C64126309076D8169239A721AE8B34784B639B3A3E2BF50D6EE34
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h...;...;...;..];...;...;...;.._;...;..h;0..;..i;'..;..X;...;..l;D..;?M.;...;..Y;...;..^;...;Rich...;........PE..L...92.K...........!.........d...............................................p .....O. ...@.........................@.......@...P..................... .h............................................i..@............................................text...S........................... ..`.data....~.......B..................@....rsrc................(..............@..@.reloc..D............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Windows\inf\setupapi.app.log

                                                                                                                            Download File
                                                                                                                            Process:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            File Type:Generic INItialization configuration [BeginLog]
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3105
                                                                                                                            Entropy (8bit):5.418453191150338
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:MVafNKN1lAtT2Coo3sksmGsdQCY4vuCoo3sruGVpiY4ksCoo3s89GegpY4PCoo36:MViNODO2I8Z4+I8OI8NI8dI8nTD
                                                                                                                            MD5:1762B3E6ECA9EE2290B5981DAF3606D0
                                                                                                                            SHA1:F812957352ABE0FDC9A91846330B0ABFB187A27D
                                                                                                                            SHA-256:49FEB44510045B7B60A9A2F9F3D7FCC93E9C7C8C2ED1C10F53E224BCD8738C09
                                                                                                                            SHA-512:463CD131547D43797F2D553B95572047ECB28AEBF6978E19754068ECC269FC29E63ED37215022897EE37D5C36CBA59887329920FCE30053670213A2FA7B44C68
                                                                                                                            Malicious:false
                                                                                                                            Reputation:low
                                                                                                                            Preview:[Device Install Log].. OS Version = 6.1.7601.. Service Pack = 1.0.. Suite = 0x0100.. ProductType = 1.. Architecture = x86....[BeginLog]....[Boot Session: 2023/10/31 10:29:22.419]....>>> [SetupInstallFromInfSection - x64_Install]..>>> Section start 2023/10/31 12:06:51.920.. cmd: "C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe" /silent.. cpy: Open PnpLockdownPolicy: Err=2. This is OK. Use LockDownPolicyDefault.. flq: CopyFile: 'C:\Users\user\AppData\Local\Temp\DX49EC.tmp\xinput1_3.dll'.. flq: to: 'C:\Windows\SysWOW64\SET4357.tmp'.. flq: MoveFile: 'C:\Windows\SysWOW64\SET4357.tmp'.. flq: to: 'C:\Windows\SysWOW64\xinput1_3.dll'..<<< Section end 2023/10/31 12:06:52.030..<<< [Exit status: SUCCESS]......>>> [SetupInstallFromInfSection - x64_install]..>>> Section start 2023/10/31 12:06:52.264.. cmd: "C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe" /silent.. cpy: Open PnpLockdownPolicy: Err=2. Thi

                                                                                                                            Static File Info

                                                                                                                            ⊘No static file info

                                                                                                                            Network Behavior

                                                                                                                            ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                            Statistics

                                                                                                                            CPU Usage

                                                                                                                            Click to jump to process

                                                                                                                            Memory Usage

                                                                                                                            Click to jump to process

                                                                                                                            High Level Behavior Distribution

                                                                                                                            Click to dive into process behavior distribution

                                                                                                                            Behavior

                                                                                                                            Click to jump to process

                                                                                                                            System Behavior

                                                                                                                            General

                                                                                                                            Target ID:0
                                                                                                                            Start time:12:02:01
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine" > cmdline.out 2>&1
                                                                                                                            Imagebase:0x49e90000
                                                                                                                            File size:302'592 bytes
                                                                                                                            MD5 hash:AD7B9C14083B52BC532FBA5948342B98
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:2
                                                                                                                            Start time:12:02:01
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\wget.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://launcher-public-service-prod06.ol.epicgames.com/launcher/api/installer/download/EpicGamesLauncherInstaller.msi?productName=unrealEngine"
                                                                                                                            Imagebase:0x400000
                                                                                                                            File size:3'895'184 bytes
                                                                                                                            MD5 hash:3DADB6E2ECE9C4B3E1E322E617658B60
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:5
                                                                                                                            Start time:12:02:25
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\System32\msiexec.exe
                                                                                                                            Wow64 process (32bit):false
                                                                                                                            Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\download\EpicInstaller-15.17.1-unrealEngine.msi"
                                                                                                                            Imagebase:0xffc80000
                                                                                                                            File size:128'512 bytes
                                                                                                                            MD5 hash:AC2E7152124CEED36846BD1B6592A00F
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:false

                                                                                                                            General

                                                                                                                            Target ID:6
                                                                                                                            Start time:12:02:26
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\System32\msiexec.exe
                                                                                                                            Wow64 process (32bit):false
                                                                                                                            Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                                                            Imagebase:0xffc80000
                                                                                                                            File size:128'512 bytes
                                                                                                                            MD5 hash:AC2E7152124CEED36846BD1B6592A00F
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:false

                                                                                                                            General

                                                                                                                            Target ID:7
                                                                                                                            Start time:12:02:26
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 0E7DF1322785CF15345485DB47D418B2 C
                                                                                                                            Imagebase:0xe50000
                                                                                                                            File size:73'216 bytes
                                                                                                                            MD5 hash:4315D6ECAE85024A0567DF2CB253B7B0
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:false

                                                                                                                            General

                                                                                                                            Target ID:8
                                                                                                                            Start time:12:02:34
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIE717.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5832034 5 CustomActionManaged!CustomActionManaged.CustomActions.ValidatePathLength
                                                                                                                            Imagebase:0xc50000
                                                                                                                            File size:44'544 bytes
                                                                                                                            MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:10
                                                                                                                            Start time:12:02:40
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 15A88122D9C7CE3C2ED0F8A7531243D7
                                                                                                                            Imagebase:0xe50000
                                                                                                                            File size:73'216 bytes
                                                                                                                            MD5 hash:4315D6ECAE85024A0567DF2CB253B7B0
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:false

                                                                                                                            General

                                                                                                                            Target ID:11
                                                                                                                            Start time:12:02:40
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:rundll32.exe "C:\Windows\Installer\MSIBBA3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5598267 9 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendStart
                                                                                                                            Imagebase:0x440000
                                                                                                                            File size:44'544 bytes
                                                                                                                            MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:12
                                                                                                                            Start time:12:02:43
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:rundll32.exe "C:\Windows\Installer\MSI9A4F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5720806 15 CustomActionManaged!CustomActionManaged.CustomActions.SetStartupCmdlineArgs
                                                                                                                            Imagebase:0xfd0000
                                                                                                                            File size:44'544 bytes
                                                                                                                            MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:13
                                                                                                                            Start time:12:02:46
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:rundll32.exe "C:\Windows\Installer\MSIA826.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5724363 21 CustomActionManaged!CustomActionManaged.CustomActions.CheckReparsePoints
                                                                                                                            Imagebase:0xbd0000
                                                                                                                            File size:44'544 bytes
                                                                                                                            MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:14
                                                                                                                            Start time:12:03:29
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 9FDD17A1D0B6974DAD5652EADF261855 E Global\MSI0000
                                                                                                                            Imagebase:0xe50000
                                                                                                                            File size:73'216 bytes
                                                                                                                            MD5 hash:4315D6ECAE85024A0567DF2CB253B7B0
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:false

                                                                                                                            General

                                                                                                                            Target ID:15
                                                                                                                            Start time:12:03:29
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:rundll32.exe "C:\Windows\Installer\MSI4E94.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5647220 30 CustomActionManaged!CustomActionManaged.CustomActions.MoveChainerToFolder
                                                                                                                            Imagebase:0x360000
                                                                                                                            File size:44'544 bytes
                                                                                                                            MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:18
                                                                                                                            Start time:12:03:39
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe" /silent
                                                                                                                            Imagebase:0xa80000
                                                                                                                            File size:517'976 bytes
                                                                                                                            MD5 hash:BF3F290275C21BDD3951955C9C3CF32C
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Antivirus matches:
                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                            • Detection: 0%, Virustotal, Browse
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:22
                                                                                                                            Start time:12:03:54
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"icacls.exe" "C:\Program Files (x86)\Epic Games\Launcher" /grant "BUILTIN\Users":(OI)(CI)F
                                                                                                                            Imagebase:0x8f0000
                                                                                                                            File size:27'136 bytes
                                                                                                                            MD5 hash:1542A92D5C6F7E1E80613F3466C9CE7F
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:24
                                                                                                                            Start time:12:03:57
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"icacls.exe" "C:\ProgramData\Epic" /grant "BUILTIN\Users":(OI)(CI)F
                                                                                                                            Imagebase:0xda0000
                                                                                                                            File size:27'136 bytes
                                                                                                                            MD5 hash:1542A92D5C6F7E1E80613F3466C9CE7F
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:26
                                                                                                                            Start time:12:03:57
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:rundll32.exe "C:\Windows\Installer\MSI9171.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5975009 49 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendEnd
                                                                                                                            Imagebase:0x490000
                                                                                                                            File size:44'544 bytes
                                                                                                                            MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:28
                                                                                                                            Start time:12:03:59
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:"C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe" 43 "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\EpicOnlineServices.msi" "EOSPRODUCTID=EpicGamesLauncher" "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe" com.epicgames.launcher://unrealEngine
                                                                                                                            Imagebase:0x1330000
                                                                                                                            File size:24'016 bytes
                                                                                                                            MD5 hash:4A3181A2E93579124799A9B81263768E
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:false

                                                                                                                            General

                                                                                                                            Target ID:29
                                                                                                                            Start time:12:04:03
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:rundll32.exe "C:\Windows\Installer\MSI7D38.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5981125 57 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherEpicGamesDirLoc
                                                                                                                            Imagebase:0x730000
                                                                                                                            File size:44'544 bytes
                                                                                                                            MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:30
                                                                                                                            Start time:12:04:04
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:rundll32.exe "C:\Windows\Installer\MSI7F99.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5981733 63 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherInstallDirLoc
                                                                                                                            Imagebase:0x3f0000
                                                                                                                            File size:44'544 bytes
                                                                                                                            MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:31
                                                                                                                            Start time:12:04:04
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:rundll32.exe "C:\Windows\Installer\MSI822A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5982373 69 CustomActionManaged!CustomActionManaged.CustomActions.SetServiceWrapperDirLoc
                                                                                                                            Imagebase:0xed0000
                                                                                                                            File size:44'544 bytes
                                                                                                                            MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:32
                                                                                                                            Start time:12:04:07
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:rundll32.exe "C:\Windows\Installer\MSI8AE2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5984619 75 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendStart
                                                                                                                            Imagebase:0x8d0000
                                                                                                                            File size:44'544 bytes
                                                                                                                            MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            General

                                                                                                                            Target ID:33
                                                                                                                            Start time:12:04:14
                                                                                                                            Start date:31/10/2023
                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            Wow64 process (32bit):true
                                                                                                                            Commandline:rundll32.exe "C:\Windows\Installer\MSIA8D2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5812581 97 CustomActionManaged!CustomActionManaged.CustomActions.RegisterProductID
                                                                                                                            Imagebase:0x40000
                                                                                                                            File size:44'544 bytes
                                                                                                                            MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                                            Reputation:low
                                                                                                                            Has exited:true

                                                                                                                            Disassembly

                                                                                                                            Reset < >

                                                                                                                              Non-executed Functions

                                                                                                                              Function 00C15488 Relevance: .4, Instructions: 373COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.386152257.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C15000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_c15000_wget.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 9288546f7d8f44d419c61f74a2ec74161fbc5736f76290489385c9c9bc8aa758
                                                                                                                              • Instruction ID: bcc034f36b550cff9d88c491e3115fe3a1461b4e3adb202dd712ea1a037556a9
                                                                                                                              • Opcode Fuzzy Hash: 9288546f7d8f44d419c61f74a2ec74161fbc5736f76290489385c9c9bc8aa758
                                                                                                                              • Instruction Fuzzy Hash: 50E1262250EBC19FD71387345CA85D57FB1AE63225B1E02CBD0D9CF1E3D2581A9AC7A2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00C270BB Relevance: .2, Instructions: 239COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.386152257.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C15000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_c15000_wget.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e219c6782fc6036a599ca4c4726786d0479a3e31b596e07ff2c2b9534054ddef
                                                                                                                              • Instruction ID: adbdbd6d84841de49ef6bea1bd401c2dd840bf84f6f012480e83c3dd6b4e5ac0
                                                                                                                              • Opcode Fuzzy Hash: e219c6782fc6036a599ca4c4726786d0479a3e31b596e07ff2c2b9534054ddef
                                                                                                                              • Instruction Fuzzy Hash: 6081013500E3E1AEDB03CF34D9A7992BF65BE1331471986CED4C18E8A3C261666AC756
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00C1E95B Relevance: .1, Instructions: 73COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000002.00000002.386152257.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C15000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_2_2_c15000_wget.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: ddedbfd8394f790464cd1248fef811493e465b412b68ae581ed81555ba730b8b
                                                                                                                              • Instruction ID: 5e77fd8d5ee8423fcef1531269411a73374e257cb6beba93b2246ceb59472d80
                                                                                                                              • Opcode Fuzzy Hash: ddedbfd8394f790464cd1248fef811493e465b412b68ae581ed81555ba730b8b
                                                                                                                              • Instruction Fuzzy Hash: 19219D6804E3C18FC793473168266D27FB16E67220B5E54DBC8E1CF4A3D25A0D9DE762
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 008F103C Relevance: 3.9, Strings: 3, Instructions: 143COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p$LRp$lY<
                                                                                                                              • API String ID: 0-1584651192
                                                                                                                              • Opcode ID: 7da42a379f167d1e6f6ef7979c6b212b62848786cb8686820b39e08183ba8323
                                                                                                                              • Instruction ID: d989931a1a97099f283c4cd691624d36ead067be1ea72d629f8ed92e317ef95b
                                                                                                                              • Opcode Fuzzy Hash: 7da42a379f167d1e6f6ef7979c6b212b62848786cb8686820b39e08183ba8323
                                                                                                                              • Instruction Fuzzy Hash: F241F4307042195FDB0AAB389C6577F3BA6FBD6304F14446EE506CB39ADE389C068791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F1630 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: $p$$p
                                                                                                                              • API String ID: 0-580715581
                                                                                                                              • Opcode ID: ce4e7d77eabdf6ba3b0646b71369a9d2c487b6a94f916400e172284ea33ce030
                                                                                                                              • Instruction ID: 38be5cf5ee4ec02bbdb94bbe6c76e06f93f78e4bff4d07a79bccc100bccd3f61
                                                                                                                              • Opcode Fuzzy Hash: ce4e7d77eabdf6ba3b0646b71369a9d2c487b6a94f916400e172284ea33ce030
                                                                                                                              • Instruction Fuzzy Hash: 4751E431B002099FCB19EF78D8546AEBBF6FFC5310B64852AD508D7359DA308D06CB91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F104C Relevance: 2.6, Strings: 2, Instructions: 92COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p$xY<
                                                                                                                              • API String ID: 0-4112300173
                                                                                                                              • Opcode ID: ad30d66d1353ba2987295422643ff5439c0db0609999acebd2a48cfc1e9a9fd7
                                                                                                                              • Instruction ID: e00b2b76b63b7517042bf574a278088f3a3147901e30064071ce28bdec97e8f5
                                                                                                                              • Opcode Fuzzy Hash: ad30d66d1353ba2987295422643ff5439c0db0609999acebd2a48cfc1e9a9fd7
                                                                                                                              • Instruction Fuzzy Hash: 9A214B317043185FD7256779A85477E7BAAEFC6310F148066FA0AC7395CE345C4283A6
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F1080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: abd3f9bd664f32ac3ed277ffac65d7a9fe61cf08269c39d930406ad2cfef850f
                                                                                                                              • Instruction ID: 2c88ba6878eadaeb7cc874459388876dba1902593b0453efcf38e054a9ca95ca
                                                                                                                              • Opcode Fuzzy Hash: abd3f9bd664f32ac3ed277ffac65d7a9fe61cf08269c39d930406ad2cfef850f
                                                                                                                              • Instruction Fuzzy Hash: E171A535B006188FDB099BB5C854B7EB6A7FFC8300F258129E606DB3A5DE35DD428B51
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F101F Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: LRp
                                                                                                                              • API String ID: 0-3405495957
                                                                                                                              • Opcode ID: c301919f73de60799cb1300a8897358b4531a4f6e6987249a9f1ef150070b8b4
                                                                                                                              • Instruction ID: e4d1ff6ba88128c4fce37aab2ae2f3fa595db3d628dad9ed9c37a03fcce43a1c
                                                                                                                              • Opcode Fuzzy Hash: c301919f73de60799cb1300a8897358b4531a4f6e6987249a9f1ef150070b8b4
                                                                                                                              • Instruction Fuzzy Hash: D541CF72B002188BDF199A799C54BBE77EAFFD4314F04402AEA06D7295EE34ED418791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F0C1C Relevance: 1.4, Strings: 1, Instructions: 105COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: 287c2e2d2f2b29390f409e0a4e9e3b0e51187e85b3939a6e422114869a60982a
                                                                                                                              • Instruction ID: 93ff9a5d87ac19a1996c24f291fa08c7cbd2fec210c0ebdea2d7ee604aee6094
                                                                                                                              • Opcode Fuzzy Hash: 287c2e2d2f2b29390f409e0a4e9e3b0e51187e85b3939a6e422114869a60982a
                                                                                                                              • Instruction Fuzzy Hash: 1031F720B4434C9FDB156778882937E3FE6EBCA300F5444AAD146DB292CE755C0687A2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F2798 Relevance: 1.3, Strings: 1, Instructions: 91COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: ,Z<
                                                                                                                              • API String ID: 0-2704125903
                                                                                                                              • Opcode ID: e40d6cf08dd7671fe724bfd1295c824fb211f94471eaf52e598f29d4f634c957
                                                                                                                              • Instruction ID: 245deff0ced6197703c5fa8356c9a32e0f7df88d1cdc38146f2f92ccd300858f
                                                                                                                              • Opcode Fuzzy Hash: e40d6cf08dd7671fe724bfd1295c824fb211f94471eaf52e598f29d4f634c957
                                                                                                                              • Instruction Fuzzy Hash: 7D21283164536C6FCB0237B998157FA3F69EF42321F5044A7FA48CB152D9249C5493E1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F28A4 Relevance: .4, Instructions: 411COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: f0f790cf977440a49cba28a0681f381239a49ff508be8c86d1ca4384249e2d87
                                                                                                                              • Instruction ID: 05e00897cc4186be14996671dc1bb64ec62f3cbf71cd1d882d5ecfbc429f7a35
                                                                                                                              • Opcode Fuzzy Hash: f0f790cf977440a49cba28a0681f381239a49ff508be8c86d1ca4384249e2d87
                                                                                                                              • Instruction Fuzzy Hash: 00F08920219B984FD712177958613B57BEDFF43714F0404EAD9C1CB693D9959C4683A2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F2E10 Relevance: .2, Instructions: 161COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 308d0b9b7876cb0dcef0705e3dd5d92a7b8ca9fb65e2be7db565eff4d55aadd3
                                                                                                                              • Instruction ID: 2fd116fd88ee9df609e8f06399a6f62efa9ff0a6311d165f237c82e08119e61f
                                                                                                                              • Opcode Fuzzy Hash: 308d0b9b7876cb0dcef0705e3dd5d92a7b8ca9fb65e2be7db565eff4d55aadd3
                                                                                                                              • Instruction Fuzzy Hash: 52413A367047185FDB259B79A890B7F77AAFFC5710B14846AE606CB355CE30AC0683A1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F2488 Relevance: .1, Instructions: 116COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 02deb657905279b62927bebe37c3c1be15189a3e1b0174b8625eb5d55337b090
                                                                                                                              • Instruction ID: 258e248728165f3ac6fc1e96b5bcd9d0905fee21a836e3b615053ae61049d1d1
                                                                                                                              • Opcode Fuzzy Hash: 02deb657905279b62927bebe37c3c1be15189a3e1b0174b8625eb5d55337b090
                                                                                                                              • Instruction Fuzzy Hash: DB418C34A0061ADBCB10DFA8D8606AEF7B5FB88300F10866ADA14EB345DB31DD55CBD2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F2268 Relevance: .1, Instructions: 106COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 7cc044931fcf9eecd89f88a9d87d2ff8961a7cc33f2999f1229284e3d19cb8d9
                                                                                                                              • Instruction ID: 1c70a47eb058be4e5bc5cbb41d8405c6f50a8789aede7c6626ed7b9059d741e1
                                                                                                                              • Opcode Fuzzy Hash: 7cc044931fcf9eecd89f88a9d87d2ff8961a7cc33f2999f1229284e3d19cb8d9
                                                                                                                              • Instruction Fuzzy Hash: 33411875B001189FCB54DF78D8809AEBBB6FF88310B14816AEA05EB365DB31ED41CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F105C Relevance: .1, Instructions: 66COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 57dcd61045e8cede1260a31b47f8b64ebf942923df65db961633d5bf5ffc1f1a
                                                                                                                              • Instruction ID: a7e458c37376ffbed26998158e5e849f631d9aa0056fd153b507fa6221dc424c
                                                                                                                              • Opcode Fuzzy Hash: 57dcd61045e8cede1260a31b47f8b64ebf942923df65db961633d5bf5ffc1f1a
                                                                                                                              • Instruction Fuzzy Hash: 5511252471979C1FD726237C5C6077A3B9EEF82320F0404AEEA41CB283CD54AC4683E2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F1378 Relevance: .1, Instructions: 55COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 3cb46ffb2af2c1cda6ca79f788d30b10243dc68e9e4214555b3016e1b52ba551
                                                                                                                              • Instruction ID: 881317702113b42cd722b2e62b672fe029ef2694a1e4b929de74ddec7812657e
                                                                                                                              • Opcode Fuzzy Hash: 3cb46ffb2af2c1cda6ca79f788d30b10243dc68e9e4214555b3016e1b52ba551
                                                                                                                              • Instruction Fuzzy Hash: 62210270D002098EDB10DFAAC484AEEFBF0FF88324F10852ED559A7640C779A949CFA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F1380 Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: aac2185f7a71f76ee67babbcdf8309e6bb55166e77d55a1f6c7848fa75c39770
                                                                                                                              • Instruction ID: 3d0b766de5e19f096b3c0b5c2e5ce9e8c511bab580811a86bbc617e4d807773c
                                                                                                                              • Opcode Fuzzy Hash: aac2185f7a71f76ee67babbcdf8309e6bb55166e77d55a1f6c7848fa75c39770
                                                                                                                              • Instruction Fuzzy Hash: AC11F471D002098BDB10DFAAC484BEEFBF5FF88324F10842AD519A7640C775A945CFA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F1968 Relevance: .1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e06eb37f374316e8ed69ac3c22345c3fef42f7bc4284b49b7289c2e550db5d1b
                                                                                                                              • Instruction ID: 8563692f8dc6da970c61d0f26941a332f4ffc5d45f1cb7ff6695d71e0046f23a
                                                                                                                              • Opcode Fuzzy Hash: e06eb37f374316e8ed69ac3c22345c3fef42f7bc4284b49b7289c2e550db5d1b
                                                                                                                              • Instruction Fuzzy Hash: 66113035A00654AFCB09DF65D858EA9BBBAFF8C311F144019D50AE7364CB75B8C9CBA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001AD006 Relevance: .0, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000002.410162614.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_2_1ad000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c38277118e84b131c0c89b97b9f023597ff397245350976d97a6b390368fa704
                                                                                                                              • Instruction ID: 68b6f285e9f4c760201bf0c0ee01528e59e8f1e65ac82037715d2e2ec4e33c7c
                                                                                                                              • Opcode Fuzzy Hash: c38277118e84b131c0c89b97b9f023597ff397245350976d97a6b390368fa704
                                                                                                                              • Instruction Fuzzy Hash: 11019E6140D3C09FD7134B259C987A2BFB8EF53624F1984DBE8858F6A7C2689C49C772
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F1440 Relevance: .0, Instructions: 46COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8a26f6f2ab32f9853bd654c11aaf8e49be70b9f44692c9f970f3b69f7afbbe2e
                                                                                                                              • Instruction ID: 35fbb5cbbce3666c3a7ff8893e619872d151811fb36de887d73e5f17168fbb76
                                                                                                                              • Opcode Fuzzy Hash: 8a26f6f2ab32f9853bd654c11aaf8e49be70b9f44692c9f970f3b69f7afbbe2e
                                                                                                                              • Instruction Fuzzy Hash: 3501D43060934A4FCB1ADB78987573A7FAAFED2300B0508AEC54ACB161ED10A808C795
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001AD01D Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000002.410162614.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_2_1ad000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b1c21ce6560694c02ed96e48b195a41b49776007fd811737dd704a59c4e13f70
                                                                                                                              • Instruction ID: e6a0276161f31032c918d5bcb8f86af1babbb28d935a82bcc84b3d69337fd61d
                                                                                                                              • Opcode Fuzzy Hash: b1c21ce6560694c02ed96e48b195a41b49776007fd811737dd704a59c4e13f70
                                                                                                                              • Instruction Fuzzy Hash: 1E01F775404740AAE7114E25E984B6BBFD8EF42724F28C41AFC464B686C7B9D845C6B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F182A Relevance: .0, Instructions: 43COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: ed3296f1541b2a74b9b7ca5e1888810696a82643679071ecf5045e18c80ab317
                                                                                                                              • Instruction ID: 2fe9696ad1a0052a638c6a766f2c30e2bc98e8e734aec170864a7193b6fdd5b8
                                                                                                                              • Opcode Fuzzy Hash: ed3296f1541b2a74b9b7ca5e1888810696a82643679071ecf5045e18c80ab317
                                                                                                                              • Instruction Fuzzy Hash: 1701A231B201099BDB29AA7885597FF7AB6FBC8700F20457EE102E7391CF750C068B91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F1431 Relevance: .0, Instructions: 31COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 628242d05e601e29fdd16b088fc7c399486f5432cfb0fc7ca1ec7ccb72d9ee47
                                                                                                                              • Instruction ID: 58355fc0f19037ac166d2c701121c3ae8dbf26fd292373d70296e28eca7c0da8
                                                                                                                              • Opcode Fuzzy Hash: 628242d05e601e29fdd16b088fc7c399486f5432cfb0fc7ca1ec7ccb72d9ee47
                                                                                                                              • Instruction Fuzzy Hash: 59F09070A042464EDB1ADB78987573A7FEAFFD2305F08086D8246CB265ED20A848DB85
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F17F0 Relevance: .0, Instructions: 21COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 640430cd706b98ca186bac6a7b50215677175309da112c45310a855e99e21b0f
                                                                                                                              • Instruction ID: 332397c84bb13904fb010847171ca601a933c6cef7845dfe85c4326b834ba433
                                                                                                                              • Opcode Fuzzy Hash: 640430cd706b98ca186bac6a7b50215677175309da112c45310a855e99e21b0f
                                                                                                                              • Instruction Fuzzy Hash: 7BE02B321186985FC3022B28DC114D53F7DEB0B61131400A3F581C73B7DE615C16D7D5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F0C0C Relevance: .0, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 1b77f257b759cbc351e0501de100023b0b1fee7cc07c7e5c45cca89da4fa5b94
                                                                                                                              • Instruction ID: a514c843c3019e3bee2ed64ad2ebd8840bd06cac59238fa848ae9f09ef163672
                                                                                                                              • Opcode Fuzzy Hash: 1b77f257b759cbc351e0501de100023b0b1fee7cc07c7e5c45cca89da4fa5b94
                                                                                                                              • Instruction Fuzzy Hash: 2DD0A73621051CAF87156629D845A7A775DFB453A13A04437FB02C3229CE716C459795
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 008F0440 Relevance: .0, Instructions: 10COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000008.00000003.410105947.00000000008F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_8_3_8f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: bd57fd7e34cbd5f900ef13130505c07d469293e7ddd00e8e4d04a6e197057e9a
                                                                                                                              • Instruction ID: c6a3b4b261a4154fc79cf628a15646b2404d1ea93a6d6b6ef2730864dbeb7b94
                                                                                                                              • Opcode Fuzzy Hash: bd57fd7e34cbd5f900ef13130505c07d469293e7ddd00e8e4d04a6e197057e9a
                                                                                                                              • Instruction Fuzzy Hash: FFC04CB7AA0A44CFD72A85685505BE7B3E0FB70366FC4862F858581115931EA853A914
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 008639EF Relevance: 3.1, APIs: 2, Instructions: 66COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • KiUserExceptionDispatcher.NTDLL ref: 00863A75
                                                                                                                              • KiUserExceptionDispatcher.NTDLL ref: 00863A85
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000B.00000003.424985209.0000000000860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00860000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_11_3_860000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DispatcherExceptionUser
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 6842923-0
                                                                                                                              • Opcode ID: 0867594c094890f49ba1d03e3ad13b70117ea24c199b0d06200807b68617705d
                                                                                                                              • Instruction ID: bc6efacbfade4cebeefdd53135c64b682ddadcf56e28507efbb71d4041d66a0c
                                                                                                                              • Opcode Fuzzy Hash: 0867594c094890f49ba1d03e3ad13b70117ea24c199b0d06200807b68617705d
                                                                                                                              • Instruction Fuzzy Hash: E621C372619785AFC3039B38F8185467FB9EE833243058997E480CB167D7749819CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00863A70 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • KiUserExceptionDispatcher.NTDLL ref: 00863A75
                                                                                                                              • KiUserExceptionDispatcher.NTDLL ref: 00863A85
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000B.00000003.424985209.0000000000860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00860000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_11_3_860000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DispatcherExceptionUser
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 6842923-0
                                                                                                                              • Opcode ID: 9695dae0fe6bde777e504d2639244df72209c098341bd0f08fbf1cec20d86554
                                                                                                                              • Instruction ID: 2f2e6bfe07f42438d3a4e44c2ba59310872437414e44cde3dd6a78afb192f747
                                                                                                                              • Opcode Fuzzy Hash: 9695dae0fe6bde777e504d2639244df72209c098341bd0f08fbf1cec20d86554
                                                                                                                              • Instruction Fuzzy Hash: 16E08C72301B006BC60467AAF91C82B37EDEAC9322710442AF902C3250DA349C018AA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001ED608 Relevance: .1, Instructions: 75COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000B.00000002.425055511.00000000001ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 001ED000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_11_2_1ed000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 6cecbba6a72ec78539cbfd9553512c61f6bdbca63c3f70daef0957ac9f6a5121
                                                                                                                              • Instruction ID: 4e37d071530f3a5a7650a3352f7a246416c25578cc184058b8a49b4121c8dff0
                                                                                                                              • Opcode Fuzzy Hash: 6cecbba6a72ec78539cbfd9553512c61f6bdbca63c3f70daef0957ac9f6a5121
                                                                                                                              • Instruction Fuzzy Hash: 29212571604680EFDB05CF14E9C0B2ABF65FB98314F248569E8090B24AC336D856CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001ED6F4 Relevance: .1, Instructions: 75COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000B.00000002.425055511.00000000001ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 001ED000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_11_2_1ed000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: f9885e9f855a238e2aea80936b5c830d1cec769fa5d0bce054da91dc18261605
                                                                                                                              • Instruction ID: 58930912d709bb71bbd230f2efc177c18551e0c79424ff2686d31c0b7cbef351
                                                                                                                              • Opcode Fuzzy Hash: f9885e9f855a238e2aea80936b5c830d1cec769fa5d0bce054da91dc18261605
                                                                                                                              • Instruction Fuzzy Hash: 5521F5B6904680EFDB15CF14E8C0B2ABF65FB88318F24C569E8054B246C336D856CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001ED603 Relevance: .1, Instructions: 56COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000B.00000002.425055511.00000000001ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 001ED000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_11_2_1ed000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction ID: 0f8be5fd10856f63f0eda8e8e56d5c581d4224081a50b6db92caebc8b80d88de
                                                                                                                              • Opcode Fuzzy Hash: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction Fuzzy Hash: 2A11D376504680DFDB16CF14E9C4B1ABF71FB98314F24C5A9DC094B256C336D85ACBA2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001ED6EF Relevance: .1, Instructions: 56COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000B.00000002.425055511.00000000001ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 001ED000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_11_2_1ed000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction ID: 62dd7bb9c150628844d4031c2981d45b5baa6a0536dd15acfc29118dc1f6717e
                                                                                                                              • Opcode Fuzzy Hash: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction Fuzzy Hash: 6D11D376904680CFDB16CF10D9C4B1ABF71FB84324F28C5A9D8494B616C336D85ACBA2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001ED01D Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000B.00000002.425055511.00000000001ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 001ED000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_11_2_1ed000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d5aac8ac8a095e06b3f1059721f8c3b6b72d3e4ca799923970ebf5f419155001
                                                                                                                              • Instruction ID: 33a7158ec4b8b02dd7ff467ea201c4dadd8839f231cf1c74a5cd442d064310da
                                                                                                                              • Opcode Fuzzy Hash: d5aac8ac8a095e06b3f1059721f8c3b6b72d3e4ca799923970ebf5f419155001
                                                                                                                              • Instruction Fuzzy Hash: 6E01F7714047C0AAE7104E26D884B6BFFD8DF41724F2CC41AFC484B286C779D845CAB1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001ED006 Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000B.00000002.425055511.00000000001ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 001ED000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_11_2_1ed000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 283839e2928c55e7f26706ec8292fea731afe4a5f7cf72101d37e61be20ca908
                                                                                                                              • Instruction ID: 8001ca5d6e3309d5a0a2442572dfe2c5cbae4388656b8ba0ddab06c40b0ae92b
                                                                                                                              • Opcode Fuzzy Hash: 283839e2928c55e7f26706ec8292fea731afe4a5f7cf72101d37e61be20ca908
                                                                                                                              • Instruction Fuzzy Hash: 8B012D6140D3C09ED7124B259C94A66BFB4DF43624F1D81DBE8888F2A7C2699848C772
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 007F103C Relevance: 5.1, Strings: 4, Instructions: 137COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p$LRp$Z3$lY3
                                                                                                                              • API String ID: 0-2661551061
                                                                                                                              • Opcode ID: 7f0ff6a7d268dde4932f4469e36e7c011ebd6a80f6117b9585c558dd40169aa8
                                                                                                                              • Instruction ID: c9173e852971f2f9c57d8a88df0ce1fd0a8389246e6134355991bf3af3704efa
                                                                                                                              • Opcode Fuzzy Hash: 7f0ff6a7d268dde4932f4469e36e7c011ebd6a80f6117b9585c558dd40169aa8
                                                                                                                              • Instruction Fuzzy Hash: F44115317042585FDB19AB389C9577F3AABAFC5310F14846AE906DB396DF389C028791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F1630 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: $p$$p
                                                                                                                              • API String ID: 0-580715581
                                                                                                                              • Opcode ID: 8484caa479e90be52b8e4bf88c40b44083881ba4a2d9c266faefcaca116e2fba
                                                                                                                              • Instruction ID: bb83c99928d906df8ae0a3b5739447fa2490c18e4b958c400e05e478dc42cf5e
                                                                                                                              • Opcode Fuzzy Hash: 8484caa479e90be52b8e4bf88c40b44083881ba4a2d9c266faefcaca116e2fba
                                                                                                                              • Instruction Fuzzy Hash: D451E331B00209DFCB19EFB8D8506AE7BFAAFC9350F54852AD508DB355DA349C06CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F1080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: cffd7ce2cae63221e246c562d388af7448b565282f62619ab5f9bbe82ed436b8
                                                                                                                              • Instruction ID: 116b707ae86429c0ccec2b2f9edf6bcfa730ce1b6ee0ca5b641a0486ac89883e
                                                                                                                              • Opcode Fuzzy Hash: cffd7ce2cae63221e246c562d388af7448b565282f62619ab5f9bbe82ed436b8
                                                                                                                              • Instruction Fuzzy Hash: 1671C935B00218DFDB19ABB4C854BBE76A7AFC8310F658029E606DB395DE34DD02C790
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F101F Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: LRp
                                                                                                                              • API String ID: 0-3405495957
                                                                                                                              • Opcode ID: 2765d06cf7dbef8d70667b849cd388829efc218b7ba52fcafa9f24166fccc0a8
                                                                                                                              • Instruction ID: 64b1fd717a2fd420dc778e2cea87e4a96c8db8b5641357b43d26291f0d24d344
                                                                                                                              • Opcode Fuzzy Hash: 2765d06cf7dbef8d70667b849cd388829efc218b7ba52fcafa9f24166fccc0a8
                                                                                                                              • Instruction Fuzzy Hash: 1741F672B042188BDB15DB69DC947BE77EAAF84314F44802AE606D7395EF78DD028790
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F0C1C Relevance: 1.4, Strings: 1, Instructions: 156COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: dfda839e77425150d8c7b7d4c001b6cae23efc08bb7af08505f97f85c2815002
                                                                                                                              • Instruction ID: d6d6e7d7a5478fa94010ff4610fbc32fca33846edb44e29158180f9d56cbcc7c
                                                                                                                              • Opcode Fuzzy Hash: dfda839e77425150d8c7b7d4c001b6cae23efc08bb7af08505f97f85c2815002
                                                                                                                              • Instruction Fuzzy Hash: 1B512530A04288DFCB19DB68C8A47BE7BF6AFC9310F54406AD506E7392CE795C09C791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F105C Relevance: 1.3, Strings: 1, Instructions: 22COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: ,Z3
                                                                                                                              • API String ID: 0-831697502
                                                                                                                              • Opcode ID: d5850b16466ff0533e0aab52ff86569d55f66f34d994cf43a25897ae2a4604b7
                                                                                                                              • Instruction ID: 72daa0408301efdd0b311304833a20ba25ad6610953f84456b9ea254b5ce92d7
                                                                                                                              • Opcode Fuzzy Hash: d5850b16466ff0533e0aab52ff86569d55f66f34d994cf43a25897ae2a4604b7
                                                                                                                              • Instruction Fuzzy Hash: C1D0C21561939CAFC316277858D92797F9C8F43210F4008E3EA0487213D8188C064380
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F0C48 Relevance: 1.3, Strings: 1, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: PX3
                                                                                                                              • API String ID: 0-1582252520
                                                                                                                              • Opcode ID: 0ef2366d5b446296f4fb1aecad0d55951f79159d872b4db5e0b810fbddf1dc61
                                                                                                                              • Instruction ID: bb88d6dde0cbee364412149423104529d1d659d7e75586ba829dd712a4f65d7f
                                                                                                                              • Opcode Fuzzy Hash: 0ef2366d5b446296f4fb1aecad0d55951f79159d872b4db5e0b810fbddf1dc61
                                                                                                                              • Instruction Fuzzy Hash: 87D023313106295FC705575CF054A79339CDF4D724B50046AF209CF321CD51EC0003C4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F2488 Relevance: .3, Instructions: 317COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b927ec63d2a77ad48d22d3c4f90b8aa5d0226d021a601622b114965c653e766b
                                                                                                                              • Instruction ID: db4ecdfeded3041165385e2899d37c46649feced5c41ec39f1fc8dc8cc49d90c
                                                                                                                              • Opcode Fuzzy Hash: b927ec63d2a77ad48d22d3c4f90b8aa5d0226d021a601622b114965c653e766b
                                                                                                                              • Instruction Fuzzy Hash: 0BB1E134B00219CBDB24EBA4D5947BEB7F6AF44344F248569DA05DB386DB38DC46CBA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F2268 Relevance: .1, Instructions: 106COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 7f9c7278e028b277e6f8c7417bb54feedb200d8638eebdffdedccc87dd17e87b
                                                                                                                              • Instruction ID: 285a39ac22d9e3160b74f070ac1054af710d806aa6a7bbe67f052893cd900c37
                                                                                                                              • Opcode Fuzzy Hash: 7f9c7278e028b277e6f8c7417bb54feedb200d8638eebdffdedccc87dd17e87b
                                                                                                                              • Instruction Fuzzy Hash: BA413A75B001189FCB54EF68D8849AEB7B6FF88310B108169EA05EB365DB31DD42CF90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F104C Relevance: .1, Instructions: 67COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 93d7a6e7d268cdb6e89c24943de5931d20e2f9b33fc6c135ac63c3510b38bc8b
                                                                                                                              • Instruction ID: bc796433d52f01324f2564b777008c5b30c756d5705a8be5dfaca1f40da7e8ed
                                                                                                                              • Opcode Fuzzy Hash: 93d7a6e7d268cdb6e89c24943de5931d20e2f9b33fc6c135ac63c3510b38bc8b
                                                                                                                              • Instruction Fuzzy Hash: AB114825B1835C9BD7266678682877A3B8E8F82710F0004B6EE01C7387EE5CDC0743E1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F2F88 Relevance: .1, Instructions: 63COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 7efe507b2dcd0f0765dcf61302ccb543119613a3cb2cc71237283100dd1ff61d
                                                                                                                              • Instruction ID: 9dc69453a236f85550c2bb2ce229fbf48c81f2aa7628411b97c1df558a996e02
                                                                                                                              • Opcode Fuzzy Hash: 7efe507b2dcd0f0765dcf61302ccb543119613a3cb2cc71237283100dd1ff61d
                                                                                                                              • Instruction Fuzzy Hash: 9411483220035CAFDB163AA598157F63FA99F42331F104067FE488A2A3C92C8882D391
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F1958 Relevance: .1, Instructions: 58COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: dc5de330fa82e374c58ba1d1a0cf0bb9d453e43e2857e31cfcfb55d6f4a8ad18
                                                                                                                              • Instruction ID: 7f6b941f0c9171f44c92b02a1b6c0217b2b99dc229ebe0b3ffc6b34b8c9b4bd7
                                                                                                                              • Opcode Fuzzy Hash: dc5de330fa82e374c58ba1d1a0cf0bb9d453e43e2857e31cfcfb55d6f4a8ad18
                                                                                                                              • Instruction Fuzzy Hash: DB217235A00684EFCB19CB65D8D4ABDBFFAEF8C311F554019D40AE73A1CA759889CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F1380 Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: aa626f08f619eca59865e7fecacd944e05c886276e7f38fa39d113922591b1a8
                                                                                                                              • Instruction ID: bdc80d412c6ae2a38cac7175e0f8aaa7e1d777492f874340ecf6ac454929ccd8
                                                                                                                              • Opcode Fuzzy Hash: aa626f08f619eca59865e7fecacd944e05c886276e7f38fa39d113922591b1a8
                                                                                                                              • Instruction Fuzzy Hash: 5E11F471D002098BDB10DFAAC484BEEFBF4FF88324F50842AD51967640C775A945CFA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F1968 Relevance: .1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 22397d5a3ec7d8823ff7e4cccc150640418e3a85f07838023e720a607bdbb0d3
                                                                                                                              • Instruction ID: 021a6aff60b112f1877e02a33892144618ede7ca374985c89cb93079396219d4
                                                                                                                              • Opcode Fuzzy Hash: 22397d5a3ec7d8823ff7e4cccc150640418e3a85f07838023e720a607bdbb0d3
                                                                                                                              • Instruction Fuzzy Hash: B3115435600644EFC709DF55D8D4AAD7BFAEF8C321F158019D509A73A1CF759889CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001BD006 Relevance: .0, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000002.428394843.00000000001BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001BD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_2_1bd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: cd7889d5d1a55a042dbf1be898839f3cd7c128d19e32ac4dd5cc77e880298fda
                                                                                                                              • Instruction ID: b810eec628f7f5b6de4f3f47f05608ee7c6eee47f303bce68aefc6205e8636b4
                                                                                                                              • Opcode Fuzzy Hash: cd7889d5d1a55a042dbf1be898839f3cd7c128d19e32ac4dd5cc77e880298fda
                                                                                                                              • Instruction Fuzzy Hash: F6016D6140D3C09FD7164B259C947A2BFA8DF53624F1984DBE8888F1A7D3699C48C771
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001BD01D Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000002.428394843.00000000001BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001BD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_2_1bd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8c095984e48809eb20a6d5d6c6ad2235a450e4181b0cda98520dc68b3647e494
                                                                                                                              • Instruction ID: 1f93a466fca3eb21e90361140ef57663a16268a681f727c553d220e4d35417e8
                                                                                                                              • Opcode Fuzzy Hash: 8c095984e48809eb20a6d5d6c6ad2235a450e4181b0cda98520dc68b3647e494
                                                                                                                              • Instruction Fuzzy Hash: 3001A771504340AAE7186E25E8C4BA7BFD8DF45724F28C41AFC494B286D779D845CAB1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F1440 Relevance: .0, Instructions: 42COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: a9bad8190fd55eeace18505a0eb403cb7c050105a7a5a80b87acd580c5f35248
                                                                                                                              • Instruction ID: 83c7263520071302d15842e832760f26399279279fb6772c335b16196deaaea9
                                                                                                                              • Opcode Fuzzy Hash: a9bad8190fd55eeace18505a0eb403cb7c050105a7a5a80b87acd580c5f35248
                                                                                                                              • Instruction Fuzzy Hash: 4C013B706093854FD71EDF789DA523A7FFAAEC3311F4904AAC145CF2A6D925980CC791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F2AB1 Relevance: .0, Instructions: 32COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: f3aa446f5f0328fe755b11e3d60ef94f0cb5a5786ea726daae2cddb7c77570ca
                                                                                                                              • Instruction ID: fe525f4def36a8a98c2290bb1fc3665c2f9c25fee55f89d203e15bc2cccbaa14
                                                                                                                              • Opcode Fuzzy Hash: f3aa446f5f0328fe755b11e3d60ef94f0cb5a5786ea726daae2cddb7c77570ca
                                                                                                                              • Instruction Fuzzy Hash: AEF0E52271839C9FEB26956846247763B9D4B96714F004076DE40CB387FACCDC8283E1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F2888 Relevance: .0, Instructions: 22COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 3f99b77f03847c7fe0879051512aa2dbabacd3947e2f7c00585975221bbdc13d
                                                                                                                              • Instruction ID: 347991b2339fc466a273a69e9b1c285316ac8ac7d82164fab29786fc76329f86
                                                                                                                              • Opcode Fuzzy Hash: 3f99b77f03847c7fe0879051512aa2dbabacd3947e2f7c00585975221bbdc13d
                                                                                                                              • Instruction Fuzzy Hash: 6AE0CAB1D0022DDF8B44EFA999011EEBBF4AF48240F10816ADA19E3300E7399A41CBA4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F2B38 Relevance: .0, Instructions: 22COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 79727e0ebd58817e59fab07eca1fdc09071ec781e36c041e834fc7f47e042b40
                                                                                                                              • Instruction ID: 3242e186714b6919f5c1102ef5d7fbb6d1c10276691b12620ddeee15ca313133
                                                                                                                              • Opcode Fuzzy Hash: 79727e0ebd58817e59fab07eca1fdc09071ec781e36c041e834fc7f47e042b40
                                                                                                                              • Instruction Fuzzy Hash: 5DD0C236A1A3184FC71166B864045B57B9C8B82720F0104E2DE04C7313E42C9C064390
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F17F0 Relevance: .0, Instructions: 21COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 82fd0cdde4584486cf38509463835578e56644d46e2bf03129e7d8dd33c99e43
                                                                                                                              • Instruction ID: 938c6ab27c5aaea70655b3e8ee1e095bc5556582a31c0e54000ca0fb3f0b5620
                                                                                                                              • Opcode Fuzzy Hash: 82fd0cdde4584486cf38509463835578e56644d46e2bf03129e7d8dd33c99e43
                                                                                                                              • Instruction Fuzzy Hash: 29E02B371092889FC306AF24D8514E63F7D9B5F22070440A3F641CB3B3C9659C16C7E0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F0C0C Relevance: .0, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 92f9008b1f1f3d89a9a245a20d889b8fd850a4f720d9e3f3ab26ca08c0ad5ea5
                                                                                                                              • Instruction ID: 6f0d51b65ca058632ce0c310ebedc485d2701fa396ee6ea21b91c69bdb3fda78
                                                                                                                              • Opcode Fuzzy Hash: 92f9008b1f1f3d89a9a245a20d889b8fd850a4f720d9e3f3ab26ca08c0ad5ea5
                                                                                                                              • Instruction Fuzzy Hash: F3D0A73621051CAB42156618D885A7A779DEB453B07A04433FA0183365CE659C1583D5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 007F0440 Relevance: .0, Instructions: 13COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000C.00000003.428283752.00000000007F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007F0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_12_3_7f0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: fdd3e41c285102ad5b64d30df4e28fc7dd711de4816de584c57db5690ab57442
                                                                                                                              • Instruction ID: 12ebf307d06d5fe3e2f35780448203cd27f4ec8f203024811b3df556d29056b7
                                                                                                                              • Opcode Fuzzy Hash: fdd3e41c285102ad5b64d30df4e28fc7dd711de4816de584c57db5690ab57442
                                                                                                                              • Instruction Fuzzy Hash: 89D0127692D7C48FC753826819944B56F607D632047CE4297C6C4C6613911ECC5AD3A1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 00921630 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: $p$$p
                                                                                                                              • API String ID: 0-580715581
                                                                                                                              • Opcode ID: 6cae5c89e6dfc2eb0530bec9942f1f474c8a5eb594f557f922b56aa001bc2e15
                                                                                                                              • Instruction ID: 93e0f1d851d7e2606e5e37ca642ce960047da29a22ba230f1c8fa8b3cd8278b4
                                                                                                                              • Opcode Fuzzy Hash: 6cae5c89e6dfc2eb0530bec9942f1f474c8a5eb594f557f922b56aa001bc2e15
                                                                                                                              • Instruction Fuzzy Hash: 5251D335B002159FCB19DF78E8406AEBBFAFFD9350B14852AE405D7359DA308C16C791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00921080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: 3bc2b72f665c20ceb4ae84e489a60917ec1b0e0093a0f6b70d8fb47e46fc9e00
                                                                                                                              • Instruction ID: cd2680475642128643134f82946f8043c614f90581a4772da4162510078feae3
                                                                                                                              • Opcode Fuzzy Hash: 3bc2b72f665c20ceb4ae84e489a60917ec1b0e0093a0f6b70d8fb47e46fc9e00
                                                                                                                              • Instruction Fuzzy Hash: 1171E835B00224CFCB09DB75D814BAEB6A7AFD8300F158429E506DB3A9DE34DD52C780
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0092101F Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: LRp
                                                                                                                              • API String ID: 0-3405495957
                                                                                                                              • Opcode ID: 4c74685941f4484f7850ddc6972249dd1c3458f8aec205117bbf536d61a02508
                                                                                                                              • Instruction ID: e37b9f06e5eb5b382b2579cbe5019480620bca745c26d4bd80b3730ac0b38a02
                                                                                                                              • Opcode Fuzzy Hash: 4c74685941f4484f7850ddc6972249dd1c3458f8aec205117bbf536d61a02508
                                                                                                                              • Instruction Fuzzy Hash: A2412132B042249BCB19DB29AC54BBE77EEAFC8314F04843AE506C7299EF34CD058790
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00920C1C Relevance: 1.4, Strings: 1, Instructions: 103COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: 2c91446bab2f55c92f27bd20b0fa2c46782500bb07629379447d6dea3a20330d
                                                                                                                              • Instruction ID: eb8d4a15c0d47e5b785502a57f0f5565a97f97ddaa1284073d7b2f1e9bf9c3bb
                                                                                                                              • Opcode Fuzzy Hash: 2c91446bab2f55c92f27bd20b0fa2c46782500bb07629379447d6dea3a20330d
                                                                                                                              • Instruction Fuzzy Hash: 9531E9347043659FD71A6738A82537E3FA69FC6304F1544AAD406DB2D6CE794C4583A1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00922E68 Relevance: .1, Instructions: 123COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 7531d96ba98035b98098be8da85c69fe28e06de2caa00ad655f5c8d616068443
                                                                                                                              • Instruction ID: 84bf8b723b941f155d8fdadb7d3b022577ad9bac64052fb9f675a868b860588c
                                                                                                                              • Opcode Fuzzy Hash: 7531d96ba98035b98098be8da85c69fe28e06de2caa00ad655f5c8d616068443
                                                                                                                              • Instruction Fuzzy Hash: 9131C435B002159FDB14DB7DA851AEFB7AAEFC8321B11842AE50ADB344DE34980687D0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00922268 Relevance: .1, Instructions: 106COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: cba1fd4843f2a587a093e69d25a5428ecdcb25f536801058ed9034a64579289a
                                                                                                                              • Instruction ID: da4633cf3f09e8bfae7dbc68bb7c110352b7b6f7c7af04cf6bcff99cbc566158
                                                                                                                              • Opcode Fuzzy Hash: cba1fd4843f2a587a093e69d25a5428ecdcb25f536801058ed9034a64579289a
                                                                                                                              • Instruction Fuzzy Hash: D5412975B00214DFCB54DF69E88499EBBB6FF88710B108169E905EB325EB31DC41CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00921378 Relevance: .1, Instructions: 55COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 50a4e96fccafeae3afcd279af2bfd68a74aa0934d79ca59d4d1e7652593ae7f6
                                                                                                                              • Instruction ID: 37cf53e9075174a0fc0c18942614c1acea9d3462a4cfcacddd9c7d4e55fbecd5
                                                                                                                              • Opcode Fuzzy Hash: 50a4e96fccafeae3afcd279af2bfd68a74aa0934d79ca59d4d1e7652593ae7f6
                                                                                                                              • Instruction Fuzzy Hash: 87210470D002098ECB20DFAAC484AEEFBF4FF88324F10852ED419A7650C7795945CFA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00921380 Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 9b3f6057dd1f3d487f4bcd6fb5c999dc21a52af5daab36f347ebe8fa9b12afb1
                                                                                                                              • Instruction ID: f42b4b71648016d476bf094fb32193291b3c49c31d96b6806c540ff62b723384
                                                                                                                              • Opcode Fuzzy Hash: 9b3f6057dd1f3d487f4bcd6fb5c999dc21a52af5daab36f347ebe8fa9b12afb1
                                                                                                                              • Instruction Fuzzy Hash: 0D11F4B1D002098BDB20DFAAC884BEEFBF5FF48324F10842AD81967654C774A945CFA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00921968 Relevance: .1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 5b53693adb20b34940bd5a28b1152496f02dbc943b383b2fef97fe9acb585cc2
                                                                                                                              • Instruction ID: c267e46db3d991704b11cf2f89d5c95240e07dd69eefacb53680af547e2c0396
                                                                                                                              • Opcode Fuzzy Hash: 5b53693adb20b34940bd5a28b1152496f02dbc943b383b2fef97fe9acb585cc2
                                                                                                                              • Instruction Fuzzy Hash: 15111235600644EFDB05DF95EC58AE97BBAEFCC311F148019D40AA7364CF759989CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00921440 Relevance: .0, Instructions: 46COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: bb1c89e11cb61bbc7311ebeda5dac25c1cf4bf831470706b8ba08be88dcfe246
                                                                                                                              • Instruction ID: 3095d8c19f7e7e5b4cbc3ce8731c89baa9e85e12d671c1111ed6e2c200f1ac1d
                                                                                                                              • Opcode Fuzzy Hash: bb1c89e11cb61bbc7311ebeda5dac25c1cf4bf831470706b8ba08be88dcfe246
                                                                                                                              • Instruction Fuzzy Hash: 3001D8306093464FD70AE778ACB536A7FAE9FD6304B0515BEC449CB175ED108809C781
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001ED01D Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000002.436293607.00000000001ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 001ED000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_2_1ed000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: a2bb27c84daff6a6fb8a196d3036105585b213dc4ad1a60e572ae1925b6867f3
                                                                                                                              • Instruction ID: 1ec83542e41e4c0043bb16e8d5f5380c1dc1a93d9fdd4362441af38f89ebe31e
                                                                                                                              • Opcode Fuzzy Hash: a2bb27c84daff6a6fb8a196d3036105585b213dc4ad1a60e572ae1925b6867f3
                                                                                                                              • Instruction Fuzzy Hash: 2A01F771404780AEE7204E2AD884B6BFFD8DF41764F2CC41AFC444B286C779D845C6B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001ED006 Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000002.436293607.00000000001ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 001ED000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_2_1ed000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b633cb81409c45d653885887b3d1f02d5043e2ee0d0a60d65d3939b905ba51ff
                                                                                                                              • Instruction ID: 39e6176f57e18e156a72dc4f17a3ef2cf87cb4e9713a0430d49b09c67bd2eec1
                                                                                                                              • Opcode Fuzzy Hash: b633cb81409c45d653885887b3d1f02d5043e2ee0d0a60d65d3939b905ba51ff
                                                                                                                              • Instruction Fuzzy Hash: 19014C7140E3C09FD7128B259C94B66BFB4DF43624F1D81DBE8888F2A7C2699848C772
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0092182A Relevance: .0, Instructions: 44COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 2cfa32b7ed8b3326a0963fffe95c8fb386081a40ca4f374287548faa5c280358
                                                                                                                              • Instruction ID: ebaac1712af00206699a0bb2c3232ad3efd77094e9a3e491fc88a53ffa163c33
                                                                                                                              • Opcode Fuzzy Hash: 2cfa32b7ed8b3326a0963fffe95c8fb386081a40ca4f374287548faa5c280358
                                                                                                                              • Instruction Fuzzy Hash: 86012630B041258BE729966898A57EF3AB65BC8300F24047ED002E73D6CE754C4287D1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00921431 Relevance: .0, Instructions: 31COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 157f7400458e34899af265767a37ef4b1869a3628a91309c3fcb68fcfe10652c
                                                                                                                              • Instruction ID: 8656dbb63c2fc5f1457da05d56e75f9d290fe1714c4e00324f646ed6df1e0149
                                                                                                                              • Opcode Fuzzy Hash: 157f7400458e34899af265767a37ef4b1869a3628a91309c3fcb68fcfe10652c
                                                                                                                              • Instruction Fuzzy Hash: 50F0BB74A052464ED70AE7B8A8B536A7F9AAFDA305F09147DC1498F275DD214809C780
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 009217F0 Relevance: .0, Instructions: 21COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e11655f67d3b1edb712d2f9b47e7d8760db1cb91e0c158b59bb914851323a233
                                                                                                                              • Instruction ID: 8ffdf25ce95112c362eccc113edcb628e49818631b89d270f71e2add7edffe38
                                                                                                                              • Opcode Fuzzy Hash: e11655f67d3b1edb712d2f9b47e7d8760db1cb91e0c158b59bb914851323a233
                                                                                                                              • Instruction Fuzzy Hash: 81E0C23224D3641FC30AAB60E8154657F799B4722031480ABE841CB2B7DE650C45C3D5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00920C0C Relevance: .0, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b4a3ee811b94d3fcb0e41f224fd3acc84aff68494232608533410e57cab95105
                                                                                                                              • Instruction ID: 8468895f96c2f220d7dc5b8a29c4922d0c5a4a1312f40b011bbeceddcdf08ec4
                                                                                                                              • Opcode Fuzzy Hash: b4a3ee811b94d3fcb0e41f224fd3acc84aff68494232608533410e57cab95105
                                                                                                                              • Instruction Fuzzy Hash: 23D0A77621152CAB42156718F885A6A775DEBD93603604833F90187329CE605C559395
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00920440 Relevance: .0, Instructions: 10COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000D.00000003.436204940.0000000000920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00920000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_13_3_920000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 11a50ad08cd9f5cfe60f92de769dea923eb55258b268f20fe6677bc0012f2727
                                                                                                                              • Instruction ID: 9540b83fda1062f2fce4eb7fb29690ed85783a68e18894aec3dad9ee355b7e48
                                                                                                                              • Opcode Fuzzy Hash: 11a50ad08cd9f5cfe60f92de769dea923eb55258b268f20fe6677bc0012f2727
                                                                                                                              • Instruction Fuzzy Hash: 45C04CB7BA0550CBC70A8658A448BE933A0BBF4366FD9C37B85444982A632F8453D510
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 0090104C Relevance: 2.7, Strings: 2, Instructions: 167COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p$LRp
                                                                                                                              • API String ID: 0-1023890418
                                                                                                                              • Opcode ID: 3e26da32caf0759020d74921baa06c38400a19bdb6d11f7e1ebdf40e49b58e43
                                                                                                                              • Instruction ID: 3cc5c9b7d76266d5a3b8e04a5b9323d4ffa807da027a5550a1351d158055c2ef
                                                                                                                              • Opcode Fuzzy Hash: 3e26da32caf0759020d74921baa06c38400a19bdb6d11f7e1ebdf40e49b58e43
                                                                                                                              • Instruction Fuzzy Hash: 4A51F3317043555FDB0A9B74A818B7E7BAAFFC5300F15846AE406CB2E6DE348D05D791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00901630 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: $p$$p
                                                                                                                              • API String ID: 0-580715581
                                                                                                                              • Opcode ID: bcd1b0f93cb6ff6743cb06464649520d4d71e0dbfa8eed296522f4bd73d4977c
                                                                                                                              • Instruction ID: 3cbc0b4900db9632bfd6c33a238e440971522bf4c03f7e7582027ac72d72a9a0
                                                                                                                              • Opcode Fuzzy Hash: bcd1b0f93cb6ff6743cb06464649520d4d71e0dbfa8eed296522f4bd73d4977c
                                                                                                                              • Instruction Fuzzy Hash: 0551D031B002059FCB19DFB8D840AAEBBFABFC9350B14852AE405DB395DA308D16C7A1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00901080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: 5033a4b689dffeb5c8c2dad410d5451ffad54f0d1b97b04125ac435d1b3714aa
                                                                                                                              • Instruction ID: 7b993df9beef89ae3d950c5808933dffbe1a61c6adb3e37c1c25ec36703f19ee
                                                                                                                              • Opcode Fuzzy Hash: 5033a4b689dffeb5c8c2dad410d5451ffad54f0d1b97b04125ac435d1b3714aa
                                                                                                                              • Instruction Fuzzy Hash: C1719331B006149FDB08ABB5C855B6EB6A7BFC8300F298529E506DB3A5DE75DD028790
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00900C1C Relevance: 1.4, Strings: 1, Instructions: 105COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: 5bcf8df5b7dbb11c4d25c8bdc4752e1848a51bddb92a2a12267054f3f91c99e4
                                                                                                                              • Instruction ID: a431b9fe6bb2c35c7ae5a9f77e45442eb36e375bd133459bd62063035be68b28
                                                                                                                              • Opcode Fuzzy Hash: 5bcf8df5b7dbb11c4d25c8bdc4752e1848a51bddb92a2a12267054f3f91c99e4
                                                                                                                              • Instruction Fuzzy Hash: 2331E7317083549FD7166778982577F3FE69FC6300F2584AAE546DB2D2CE344C0997A1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00902CA8 Relevance: 1.3, Strings: 1, Instructions: 91COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: LRp
                                                                                                                              • API String ID: 0-3405495957
                                                                                                                              • Opcode ID: 0009969a7ed7728365c3d4722e4ffa4218def6baff6f0a0160d4694338b47024
                                                                                                                              • Instruction ID: 56fdaf36ec7cd95984668db0e3941d39927f39a42cd628742cae46b43c254a4a
                                                                                                                              • Opcode Fuzzy Hash: 0009969a7ed7728365c3d4722e4ffa4218def6baff6f0a0160d4694338b47024
                                                                                                                              • Instruction Fuzzy Hash: 1221A9727042169FEB099B65A859B7F7BEABFC5314F1444AAE406CB2E1EB349C018790
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00902488 Relevance: .2, Instructions: 217COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 32b7a1de06062ab7aa04a36e9ddc54290eb58d0b4aee726d472903fc6ecc218e
                                                                                                                              • Instruction ID: 79cdf4a4a8f67a3abdda928735a014d34f82fc5a2f9214fcd492adb592a4c012
                                                                                                                              • Opcode Fuzzy Hash: 32b7a1de06062ab7aa04a36e9ddc54290eb58d0b4aee726d472903fc6ecc218e
                                                                                                                              • Instruction Fuzzy Hash: 6D81A134B002158FDB05DB64D894BAEBBB6FFC9310F248669D8159B396DB31DC46CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00902268 Relevance: .1, Instructions: 106COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8e7a43bbc5956662e8f8c339b99fc660c5a63d35df58c36ef2390d866f5d8bd3
                                                                                                                              • Instruction ID: d5ef63649fcbe249c712457d60c2a74aa7057fa59d91d3be4150d8c09218e4a8
                                                                                                                              • Opcode Fuzzy Hash: 8e7a43bbc5956662e8f8c339b99fc660c5a63d35df58c36ef2390d866f5d8bd3
                                                                                                                              • Instruction Fuzzy Hash: 29413835B002189FCB54DF68D88499EBBB6FF88710F10816AE905EB364EB31DC42CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0090101F Relevance: .1, Instructions: 102COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0757cbde20db008b90685497a2de9a4e2747c7f7f956e1537e4b57ed874f8e20
                                                                                                                              • Instruction ID: fe51773f72576a326357dc06027e0248a22d8a9db5a614fc1c35d8a7bd4f7bcf
                                                                                                                              • Opcode Fuzzy Hash: 0757cbde20db008b90685497a2de9a4e2747c7f7f956e1537e4b57ed874f8e20
                                                                                                                              • Instruction Fuzzy Hash: CF310272B002148FCB199B69D8A07BE77EAEFC4350F05443AE646C7391DE74CD0A8791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00901074 Relevance: .1, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8dbe600356688b07204726e03ee6e9f85798488c92fcc58f871c780bbec60cfb
                                                                                                                              • Instruction ID: 038236225b62443f7d8e40c89855ff681e938cf1b8f2a2ffc49d3d26f5b29960
                                                                                                                              • Opcode Fuzzy Hash: 8dbe600356688b07204726e03ee6e9f85798488c92fcc58f871c780bbec60cfb
                                                                                                                              • Instruction Fuzzy Hash: 14210632B042048FDB188BB998507BEBBEAEFC8350F05807ADA06D7390DE748D468790
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00902EA5 Relevance: .1, Instructions: 61COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 44a199b85af9d1ba4a6d2b31f3a8fff36ec3ba4c7f37b84c07a6f798a2664bd2
                                                                                                                              • Instruction ID: 092ccfe50bdbe16eda8132ab5f9d3ade0c7e784b7da263c656a5c249e80644fd
                                                                                                                              • Opcode Fuzzy Hash: 44a199b85af9d1ba4a6d2b31f3a8fff36ec3ba4c7f37b84c07a6f798a2664bd2
                                                                                                                              • Instruction Fuzzy Hash: 64117F30A00645AFCB05EB65D854AAE7BB6FFCC310F158029E409A73A6CF759845CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00902EA8 Relevance: .1, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 36019517cff1bf9c279796f94bb845602f9ad566f80604a7bd442bc8848ce247
                                                                                                                              • Instruction ID: b545e9dcafd2ba2898dac03593955e192c8af372b269c0e80b2cff1ee4c4343f
                                                                                                                              • Opcode Fuzzy Hash: 36019517cff1bf9c279796f94bb845602f9ad566f80604a7bd442bc8848ce247
                                                                                                                              • Instruction Fuzzy Hash: 8E118E30A00605AFCB08EB65D854AAEBBF6FFCC310F108029E409A73A5CFB59845CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0090225C Relevance: .1, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 1f5fc7b1ac801b57a4761b8b090f8f21e70ee04d48694a2da7038d5d832dc9f4
                                                                                                                              • Instruction ID: e806dc130054a61f70c11cdf34aa5e7fb68baa1e40fb4f712942c71f6284a219
                                                                                                                              • Opcode Fuzzy Hash: 1f5fc7b1ac801b57a4761b8b090f8f21e70ee04d48694a2da7038d5d832dc9f4
                                                                                                                              • Instruction Fuzzy Hash: 4C210675E002189FCB54DF78D884A9EBBB2FF8D710F10826AE805EB361D7319846CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00901378 Relevance: .1, Instructions: 55COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b5835edb963287194945ef86b2629920abffb8aabb66a47b3360775e6310bdfa
                                                                                                                              • Instruction ID: ff226149ac41d87b07541b99477c0e5bb5fe6a82bf8343896663ca2c1a736c0e
                                                                                                                              • Opcode Fuzzy Hash: b5835edb963287194945ef86b2629920abffb8aabb66a47b3360775e6310bdfa
                                                                                                                              • Instruction Fuzzy Hash: 76210270D042098FDB10CFAAC884AEEFBB4FF88324F10852ED459A7250C775A945CFA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00901380 Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 5116748b20edc319e76def6acbcf8979c003f2b69146b77a9c8ccbb1dd16a950
                                                                                                                              • Instruction ID: b2890c945f7f2f2ca8189585515902e00e93ee3c347be8857e256d4b82e9adb6
                                                                                                                              • Opcode Fuzzy Hash: 5116748b20edc319e76def6acbcf8979c003f2b69146b77a9c8ccbb1dd16a950
                                                                                                                              • Instruction Fuzzy Hash: 7C11E271D002098EDB10DFAAC884AAEFBB4EF48324F10842AD41967250C775A945CFA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00901968 Relevance: .1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d531b56efed900a575b63713c616cc5aaa05c5285dc46ac15888650229147b1b
                                                                                                                              • Instruction ID: 4da0d47a40291d69b85d438de48adf9a7dd4023a374a1454926d7f0b4db1c4bf
                                                                                                                              • Opcode Fuzzy Hash: d531b56efed900a575b63713c616cc5aaa05c5285dc46ac15888650229147b1b
                                                                                                                              • Instruction Fuzzy Hash: B0119170600644AFCB04DF64D854AAD7BB6FF8C310F115069E40AA73A5CFB59885CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00901440 Relevance: .0, Instructions: 46COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e212a162d1b244d5442eadd46faf6cdcdbd32d065140cbbfb976d746b30998b1
                                                                                                                              • Instruction ID: 2cb76bf348ed52dfdcf8c6396f406c2330c4a3b85b873022dc287a835d88970f
                                                                                                                              • Opcode Fuzzy Hash: e212a162d1b244d5442eadd46faf6cdcdbd32d065140cbbfb976d746b30998b1
                                                                                                                              • Instruction Fuzzy Hash: 610184706097864FCB49DB7898B573A7FA9BFC2301F4615AEC54ACB2B2ED508804C792
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001FD01D Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000002.535506330.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_2_1fd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 689ed5bcafb78fa659d965699e301df309f2bf52b1610f3f7072f4f05cd8ce9b
                                                                                                                              • Instruction ID: f397dd0ba1afcfb2a7f82b4cf6e35684389e1236cf895708d6191b57ab28dd1e
                                                                                                                              • Opcode Fuzzy Hash: 689ed5bcafb78fa659d965699e301df309f2bf52b1610f3f7072f4f05cd8ce9b
                                                                                                                              • Instruction Fuzzy Hash: A501A771404344AAE7108E26D884B77BFD8DF41724F28C55AFE494B286CB79D845CAB1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001FD006 Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000002.535506330.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_2_1fd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: a76c86a891d46dd2b48435125534efe40470d840c9f2cd1a207aacdfc8d26360
                                                                                                                              • Instruction ID: f209b1591d5dc374fc990cdbd51a3109d8d23c33ed88b0dd2bc9ba9ea632376f
                                                                                                                              • Opcode Fuzzy Hash: a76c86a891d46dd2b48435125534efe40470d840c9f2cd1a207aacdfc8d26360
                                                                                                                              • Instruction Fuzzy Hash: BC01406140D3C45FD7128B259C94B62BFB4DF53224F1D81DBE9888F1A7C2699848C772
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0090182C Relevance: .0, Instructions: 42COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 5aeb91dfee55d0a838ca182bba6d4067bb091e9faeedfd3a3cf4a7041d5b2059
                                                                                                                              • Instruction ID: d95fcbf2801bc6e05ab45ea20ce2367250648b4dd95c11d1b3ac70cd69ce481d
                                                                                                                              • Opcode Fuzzy Hash: 5aeb91dfee55d0a838ca182bba6d4067bb091e9faeedfd3a3cf4a7041d5b2059
                                                                                                                              • Instruction Fuzzy Hash: 2601D631B101058FD718AA6885557EF7ABB9BC8300F24846ED506F33D0CE750D0687A1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00901431 Relevance: .0, Instructions: 31COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 002b59d93bf86c72716db6fd3bb968815a8af39231a0349dd51b21c63a107b19
                                                                                                                              • Instruction ID: bf86ab2a8828776570441bf86ec3bff8f8dfc61159369d16597e0b6b93fd6694
                                                                                                                              • Opcode Fuzzy Hash: 002b59d93bf86c72716db6fd3bb968815a8af39231a0349dd51b21c63a107b19
                                                                                                                              • Instruction Fuzzy Hash: 70F09670A05A420ED709DB78987132A7FD6BFC2310F4A146DC1458B2B6DD608804D782
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00902C58 Relevance: .0, Instructions: 28COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c6ca561867d7d6d29eed57151033e5a41ab412eb70a1415ec462532fd174531e
                                                                                                                              • Instruction ID: 0a3338b389e2a1fd0a09b51153570f6f965aef1d9db9e62549b7aad73be1bb33
                                                                                                                              • Opcode Fuzzy Hash: c6ca561867d7d6d29eed57151033e5a41ab412eb70a1415ec462532fd174531e
                                                                                                                              • Instruction Fuzzy Hash: CDF0E5313003944FC7269B34E405A2A7BF5EFC5310F0509BAE5858B286DFA4AC0E8792
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0090103C Relevance: .0, Instructions: 27COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: cb9b10feb3360b590635c96acb1a2c6e406164b92698ac3a48e3fd72a19badd2
                                                                                                                              • Instruction ID: a8eb98edbed59bdac58fa3e4aacac146a75d1c7797fff8c203e7ef98e508804a
                                                                                                                              • Opcode Fuzzy Hash: cb9b10feb3360b590635c96acb1a2c6e406164b92698ac3a48e3fd72a19badd2
                                                                                                                              • Instruction Fuzzy Hash: C9E092303107689FC725AB78E085B2E33E9EFC4751B400E39E24587245CF64AC0E4781
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00902BBB Relevance: .0, Instructions: 25COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c5daa6d075bd1e2db744eed3f7d1c451b7681f1ee2261e71b2773dc475faff72
                                                                                                                              • Instruction ID: 5a1dbb7cf7e4f8afc3b30133f3aa39839bd08ff9a1e301ac814ebb2eb8dd634d
                                                                                                                              • Opcode Fuzzy Hash: c5daa6d075bd1e2db744eed3f7d1c451b7681f1ee2261e71b2773dc475faff72
                                                                                                                              • Instruction Fuzzy Hash: EBF0DFB1E08219CFCB54EFA899455EEBBF0AF48300B2085AED45AE3350E3358A41CF91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00902BC0 Relevance: .0, Instructions: 24COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 075460177a098f84e28902cd88e09e5fd9cb6794adb380aa05bed9794ff48300
                                                                                                                              • Instruction ID: e24bf685d0e6d952c869a46efe09920fd73c72cad48fdbd666027d9b7acb73ed
                                                                                                                              • Opcode Fuzzy Hash: 075460177a098f84e28902cd88e09e5fd9cb6794adb380aa05bed9794ff48300
                                                                                                                              • Instruction Fuzzy Hash: CBF0FBB1E00229CFCB84EFA9D8055AEBBF4BF48300B10806AD41AE3350E7349A40CF90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 009032A7 Relevance: .0, Instructions: 23COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 78f58189f1df59d7d24b7489c63dcfe41508440e2abf9f4556a2be3989644be1
                                                                                                                              • Instruction ID: a8b328b0fbffe82111c07432ecf1752d1ad9dec5602cb3b343826961e7858f21
                                                                                                                              • Opcode Fuzzy Hash: 78f58189f1df59d7d24b7489c63dcfe41508440e2abf9f4556a2be3989644be1
                                                                                                                              • Instruction Fuzzy Hash: 27E08C322493A44FD70287A8E820B993FA88F4B224F1500D7E505CF263C9626C088795
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 009017F0 Relevance: .0, Instructions: 21COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 82ea51c6d5cfe3eb74ec03510a8501eb7dc34707b3365df926d7338907de83de
                                                                                                                              • Instruction ID: 282a6dcacaf62e945a6a329e237f4633868f276c500666466fa944351bcf5591
                                                                                                                              • Opcode Fuzzy Hash: 82ea51c6d5cfe3eb74ec03510a8501eb7dc34707b3365df926d7338907de83de
                                                                                                                              • Instruction Fuzzy Hash: C2E0C2332092945FC3035B64A8109A67F7DAB8B12030800A3E881CB2B3CA611C29D7E0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00900C48 Relevance: .0, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 1a5a79e65ef3f687901ff91bc2c17774739fd3f18a1b9e8468507df81124fef3
                                                                                                                              • Instruction ID: d5bb56974673449bab87e4b746855f23d76e6332e3b077acf890f38a67678133
                                                                                                                              • Opcode Fuzzy Hash: 1a5a79e65ef3f687901ff91bc2c17774739fd3f18a1b9e8468507df81124fef3
                                                                                                                              • Instruction Fuzzy Hash: 52D023313506245FC704535CF054959339DDF4D715B50047AF60DCB361CD51DC0403C4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00900C0C Relevance: .0, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: ad6dab24e8b6623bcb3d03c1b312bf4a6f7445b5975920223980271ca9b0c679
                                                                                                                              • Instruction ID: 034876afe530a9b0ad6aa88cecde7ffb362281ee8a6990ef24c0aca2cd3c9b64
                                                                                                                              • Opcode Fuzzy Hash: ad6dab24e8b6623bcb3d03c1b312bf4a6f7445b5975920223980271ca9b0c679
                                                                                                                              • Instruction Fuzzy Hash: 48D0A73221051C6F82156658E845F6A7B5DEBC53617904833FD01C3275DD605C499395
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00900440 Relevance: .0, Instructions: 10COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000000F.00000003.535345979.0000000000900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00900000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_15_3_900000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b6b770623be0e6d115264806d5200b284921a57ef9d4a3dd6aafc73ecd5e143c
                                                                                                                              • Instruction ID: 2d2aaa752d099c2968c88262f6be229c3a27ca1e775ea7470d09affc4d46011c
                                                                                                                              • Opcode Fuzzy Hash: b6b770623be0e6d115264806d5200b284921a57ef9d4a3dd6aafc73ecd5e143c
                                                                                                                              • Instruction Fuzzy Hash: EFC04CB3BA5541DBD70A855454167E5B360FB60322F89C22B854542218631D8467A554
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Execution Graph

                                                                                                                              Execution Coverage:13%
                                                                                                                              Dynamic/Decrypted Code Coverage:2.7%
                                                                                                                              Signature Coverage:2%
                                                                                                                              Total number of Nodes:2000
                                                                                                                              Total number of Limit Nodes:55
                                                                                                                              execution_graph 26956 6974e873 27087 6974b23f 26956->27087 26961 69746210 162 API calls 26962 6974e8c3 26961->26962 27125 6974ac14 26962->27125 26965 6974e8d4 27334 697493df 175 API calls ___ansicp 26965->27334 26966 6974e8ec RegOpenKeyExA 26967 6974e967 26966->26967 26968 6974e90a RegQueryValueExA 26966->26968 27335 69746391 169 API calls 3 library calls 26967->27335 26970 6974e944 26968->26970 26971 6974e957 RegCloseKey 26968->26971 26973 69746210 162 API calls 26970->26973 26971->26967 26974 6974e991 26971->26974 26972 6974e8d9 26972->26966 26982 6974e8dd 26972->26982 26977 6974e94f 26973->26977 26978 69746210 162 API calls 26974->26978 26976 6974ea51 26979 6974eceb 26976->26979 26981 6974eaa7 26976->26981 26976->26982 26977->26971 26980 6974e9ab 26978->26980 26983 6974edbb 26979->26983 26986 6974ed08 RegOpenKeyExA 26979->26986 26984 6974b5f6 199 API calls 26980->26984 27132 697472fc 26981->27132 26982->26976 27369 697485ae 26982->27369 26987 69746210 162 API calls 26983->26987 26988 6974e9c2 26984->26988 26991 6974ed8d 26986->26991 26992 6974ed29 RegDeleteValueA 26986->26992 26993 6974ede0 26987->26993 27336 69748c66 26988->27336 27378 69746391 169 API calls 3 library calls 26991->27378 26998 6974ed6c 26992->26998 26999 6974ed3e 26992->26999 27295 6974b5f6 26993->27295 26995 6974eac0 27002 6974ebb1 26995->27002 27003 6974eac8 26995->27003 26996 6974ec69 27005 697491c4 296 API calls 26996->27005 27001 69746210 162 API calls 26998->27001 27007 6974ed7d RegCloseKey 26999->27007 27377 69746391 169 API calls 3 library calls 26999->27377 27015 6974ed67 27001->27015 27177 6974b4e4 27002->27177 27016 6974eafc 27003->27016 27150 697491c4 27003->27150 27018 6974ec7e 27005->27018 27007->26983 27007->26991 27009 6974e9d7 27037 69746210 162 API calls 27009->27037 27010 6974eb13 27373 6974aa25 189 API calls ___ansicp 27010->27373 27011 6974ea3a 27368 6974a978 189 API calls ___ansicp 27011->27368 27012 6974eb47 27375 6974ab73 189 API calls ___ansicp 27012->27375 27013 6974eb2d 27374 6974aad4 189 API calls ___ansicp 27013->27374 27014 6974ea09 27367 69748484 189 API calls ___ansicp 27014->27367 27015->27007 27031 6974b5f6 199 API calls 27016->27031 27018->27016 27036 697491c4 296 API calls 27018->27036 27031->26979 27033 6974ea3f 27043 6974ea47 27033->27043 27044 6974ea0e 27033->27044 27034 6974eb32 27034->27043 27034->27044 27035 6974eb4c 27035->27043 27035->27044 27049 6974ec4c 27036->27049 27037->26976 27042 6974eb18 27042->27043 27042->27044 27062 69746210 162 API calls 27043->27062 27044->27009 27046 6974ebdf 27058 6974ebf4 27046->27058 27199 6974cec8 27046->27199 27047 6974ebc9 27055 69746210 162 API calls 27047->27055 27051 6974eb9b 27049->27051 27053 6974eca1 27049->27053 27050 6974eaf2 27054 69746210 162 API calls 27050->27054 27376 69746391 169 API calls 3 library calls 27051->27376 27063 69746210 162 API calls 27053->27063 27054->27016 27055->27016 27058->27016 27289 69749ca1 27058->27289 27062->26976 27063->27016 27070 697491c4 296 API calls 27388 69746c43 27087->27388 27090 6974b2a1 FindFirstFileA 27092 6974b2e3 FindClose 27090->27092 27093 6974b2ba GetLastError 27090->27093 27091 6974b27c 27442 69746391 169 API calls 3 library calls 27091->27442 27097 6974b2fb _strnlen 27092->27097 27108 6974b48b 27092->27108 27443 69746391 169 API calls 3 library calls 27093->27443 27095 6974b299 27101 6974fc2e ___ansicp 4 API calls 27095->27101 27107 6974b42f 27097->27107 27097->27108 27110 6974f7d4 __fcloseall 102 API calls 27097->27110 27111 6974fc12 153 API calls 27097->27111 27112 6974b3c6 27097->27112 27444 6974fc92 27097->27444 27449 69750d4a 77 API calls __fread_nolock 27097->27449 27102 6974b4dd 27101->27102 27118 69746210 27102->27118 27104 6974b4b2 27429 6974f7d4 27104->27429 27451 69746391 169 API calls 3 library calls 27107->27451 27393 6974fc12 27108->27393 27110->27097 27111->27097 27112->27097 27114 6974f7d4 __fcloseall 102 API calls 27112->27114 27117 6974b42d 27112->27117 27450 69750a5d 99 API calls 3 library calls 27112->27450 27115 6974b3e3 FindFirstFileA 27114->27115 27115->27108 27116 6974b403 FindClose 27115->27116 27116->27112 27117->27108 28140 69746028 27118->28140 27123 6974fc2e ___ansicp 4 API calls 27124 69746254 27123->27124 27124->26961 28214 697471e9 27125->28214 27131 6974ac2b 27131->26965 27131->26966 27133 697471e9 185 API calls 27132->27133 27134 6974731a 27133->27134 27135 697473ff 27134->27135 28343 69747269 27134->28343 27137 6974fc2e ___ansicp 4 API calls 27135->27137 27139 69747412 27137->27139 27139->26995 27139->26996 27140 697473bc 27140->27135 27143 697469f7 177 API calls 27140->27143 27141 69747338 27141->27135 28351 697469f7 27141->28351 27145 69747398 27143->27145 27145->27135 28363 69746b07 27145->28363 27146 69747351 LoadStringA 27146->27145 27147 69747377 GetLastError 27146->27147 28370 69746391 169 API calls 3 library calls 27147->28370 27151 697491f0 27150->27151 27152 6974921c 27151->27152 27153 6974cec8 234 API calls 27151->27153 27176 697491f5 27151->27176 27156 69749395 27152->27156 27157 69749253 27152->27157 27152->27176 27153->27152 27154 6974fc2e ___ansicp 4 API calls 27155 697493d6 27154->27155 27155->27050 27155->27051 28456 69746391 169 API calls 3 library calls 27156->28456 27159 697485ae CharNextA 27157->27159 27160 6974926d 27159->27160 27161 697485ae CharNextA 27160->27161 27162 69749279 27161->27162 28376 69748ee0 27162->28376 27176->27154 27178 6974b507 GetVersionExA 27177->27178 27192 6974b54a 27177->27192 27179 6974b527 27178->27179 27180 6974b552 27178->27180 27179->27180 27184 6974b540 27179->27184 27183 6974fc92 63 API calls 27180->27183 27181 6974fc2e ___ansicp 4 API calls 27182 6974b5ef 27181->27182 27182->27016 27182->27046 27182->27047 27186 6974b55d 27183->27186 27185 69746210 162 API calls 27184->27185 27185->27192 27187 6974b569 27186->27187 28606 6974a211 175 API calls 27186->28606 27189 6974b5bc 27187->27189 27191 6974b578 GetNativeSystemInfo 27187->27191 28607 69746391 169 API calls 3 library calls 27189->28607 27193 697485e5 171 API calls 27191->27193 27192->27181 27194 6974b58c 27193->27194 27200 6974cf00 27199->27200 27201 69747269 185 API calls 27200->27201 27202 6974cf05 27201->27202 27290 69749cac 27289->27290 27293 69749cbc 27289->27293 28661 697499e4 27290->28661 27293->27016 27293->27070 27296 6974b63d 27295->27296 27297 6974b642 27296->27297 27298 6974b64a 27296->27298 28752 6974b8f8 199 API calls _strrchr 27297->28752 28727 69749d7d 27298->28727 27304 6974b6f1 27306 6974b6da 27304->27306 27309 6974b792 27304->27309 27310 6974b708 27304->27310 27305 6974b68f 27305->27306 27307 6974b69f SetFocus 27305->27307 27308 6974fc2e ___ansicp 4 API calls 27306->27308 27307->27306 27311 6974b6aa GetLastError 27307->27311 27312 6974b6ed 27308->27312 28754 69749cd8 171 API calls 27309->28754 27313 6974b735 27310->27313 27314 6974b70d CreateDialogParamA 27310->27314 27311->27306 27314->27313 27334->26972 27335->26974 27337 69747269 185 API calls 27336->27337 27338 69748c71 27337->27338 27345 69748c75 27338->27345 28775 69748be6 27338->28775 27342 69748d1d 27342->26976 27342->27009 27342->27010 27342->27011 27342->27012 27342->27013 27342->27014 27343 697471e9 185 API calls 27344 69748c92 27343->27344 27344->27345 27346 697470ae 190 API calls 27344->27346 27345->27342 28818 6974874e 27345->28818 27347 69748ca0 27346->27347 27348 69748ca4 27347->27348 27349 69748cb7 27347->27349 28829 6974895f 189 API calls ___ansicp 27348->28829 28783 697488b4 27349->28783 27352 69748ca9 27352->27342 27352->27345 27367->27044 27368->27033 27370 697485cc 27369->27370 27371 697485be CharNextA 27369->27371 27372 6974a3ce 179 API calls ___ansicp 27370->27372 27371->27370 27371->27371 27372->26981 27373->27042 27374->27034 27375->27035 27376->27016 27377->27015 27378->26983 27389 69746be5 99 API calls 27388->27389 27390 69746c60 27389->27390 27391 69746c83 27390->27391 27452 69746391 169 API calls 3 library calls 27390->27452 27391->27090 27391->27091 27453 6974fb39 27393->27453 27395 6974b49f 27395->27095 27396 6974f855 27395->27396 27399 6974f861 __mtinitlocknum 27396->27399 27397 6974f86f 27978 697533d9 63 API calls _raise 27397->27978 27399->27397 27401 6974f935 27399->27401 27980 697535e0 27399->27980 27400 6974f874 27979 697532d7 5 API calls ___ansicp 27400->27979 27958 697538cd 27401->27958 27405 6974f8d5 27405->27397 27412 697535e0 __fileno 63 API calls 27405->27412 27407 697535e0 __fileno 63 API calls 27409 6974f8b9 27407->27409 27408 6974f94d 27964 6975399b 27408->27964 27409->27405 27414 697535e0 __fileno 63 API calls 27409->27414 27410 6974f884 __mtinitlocknum 27410->27104 27415 6974f8f2 27412->27415 27417 6974f8c5 27414->27417 27418 6974f91a 27415->27418 27422 697535e0 __fileno 63 API calls 27415->27422 27421 697535e0 __fileno 63 API calls 27417->27421 27418->27397 27418->27401 27421->27405 27424 6974f8fe 27422->27424 27423 6974f971 27987 6974f995 LeaveCriticalSection LeaveCriticalSection __fcloseall 27423->27987 27424->27418 27426 697535e0 __fileno 63 API calls 27424->27426 27427 6974f90a 27426->27427 27428 697535e0 __fileno 63 API calls 27427->27428 27428->27418 27430 6974f7e0 __mtinitlocknum 27429->27430 27431 6974f7f4 27430->27431 27432 6974f811 27430->27432 28081 697533d9 63 API calls _raise 27431->28081 27434 697538cd __fread_nolock 64 API calls 27432->27434 27440 6974f809 __mtinitlocknum 27432->27440 27436 6974f829 27434->27436 27435 6974f7f9 28082 697532d7 5 API calls ___ansicp 27435->28082 28065 6974f758 27436->28065 27440->27095 27442->27095 27443->27095 27446 6974fc9a 27444->27446 27445 697540d3 __mtinitlocknum 63 API calls 27445->27446 27446->27445 27447 6974fcb6 27446->27447 28139 697541b6 5 API calls __mtterm 27446->28139 27447->27097 27449->27097 27450->27112 27451->27108 27452->27391 27454 6974fb45 __mtinitlocknum 27453->27454 27455 6974fb58 27454->27455 27456 6974fb6a 27454->27456 27515 697533d9 63 API calls _raise 27455->27515 27457 6974fb78 27456->27457 27460 6974fb9d 27456->27460 27516 697533d9 63 API calls _raise 27457->27516 27475 69753d12 27460->27475 27461 6974fb7d 27517 697532d7 5 API calls ___ansicp 27461->27517 27464 6974fba2 27465 6974fbb6 27464->27465 27466 6974fba9 27464->27466 27468 6974fbdd 27465->27468 27469 6974fbbd 27465->27469 27518 697533d9 63 API calls _raise 27466->27518 27493 69753a6b 27468->27493 27519 697533d9 63 API calls _raise 27469->27519 27472 6974fb5d __mtinitlocknum @_EH4_CallFilterFunc@8 27472->27395 27476 69753d1e __mtinitlocknum 27475->27476 27477 69754a24 __mtinitlocknum 63 API calls 27476->27477 27478 69753d2c 27477->27478 27479 69753d9d 27478->27479 27484 6975495c __mtinitlocknum 63 API calls 27478->27484 27488 69753d99 27478->27488 27524 69753907 64 API calls __mtinitlocknum 27478->27524 27525 6975396e LeaveCriticalSection LeaveCriticalSection _doexit 27478->27525 27480 697540d3 __mtinitlocknum 63 API calls 27479->27480 27483 69753da7 27480->27483 27482 69753e24 __mtinitlocknum 27482->27464 27486 697580a8 ___crtInitCritSecAndSpinCount 63 API calls 27483->27486 27483->27488 27484->27478 27487 69753dcc 27486->27487 27489 69753dd7 27487->27489 27490 69753dea EnterCriticalSection 27487->27490 27521 69753e2f 27488->27521 27526 6975037b 63 API calls 5 library calls 27489->27526 27490->27488 27494 69753a8d 27493->27494 27495 69753aa1 27494->27495 27505 69753ac0 27494->27505 27531 697533d9 63 API calls _raise 27495->27531 27497 69753aa6 27532 697532d7 5 API calls ___ansicp 27497->27532 27499 69753cc6 27528 69759402 27499->27528 27500 69753cac 27537 697533d9 63 API calls _raise 27500->27537 27503 6974fbe8 27520 6974fc03 LeaveCriticalSection LeaveCriticalSection __fcloseall 27503->27520 27504 69753cb1 27538 697532d7 5 API calls ___ansicp 27504->27538 27505->27500 27514 69753c5c 27505->27514 27533 697597d4 73 API calls __fassign 27505->27533 27508 69753c41 27508->27500 27534 69759648 98 API calls 27508->27534 27510 69753c56 27510->27514 27535 69759648 98 API calls 27510->27535 27512 69753c73 27512->27514 27536 69759648 98 API calls 27512->27536 27514->27499 27514->27500 27515->27472 27516->27461 27517->27472 27518->27472 27519->27472 27520->27472 27527 69754940 LeaveCriticalSection 27521->27527 27523 69753e36 27523->27482 27524->27478 27525->27478 27526->27488 27527->27523 27539 69759345 27528->27539 27530 6975941d 27530->27503 27531->27497 27532->27503 27533->27508 27534->27510 27535->27512 27536->27514 27537->27504 27538->27503 27541 69759351 __mtinitlocknum 27539->27541 27540 6975935d 27626 697533d9 63 API calls _raise 27540->27626 27541->27540 27543 6975938e 27541->27543 27550 69758cf7 27543->27550 27544 69759362 27627 697532d7 5 API calls ___ansicp 27544->27627 27547 69759371 __mtinitlocknum 27547->27530 27551 69758d22 27550->27551 27629 6975aedb 27551->27629 27554 69758d4d 27556 69750f9d __get_wpgmptr 63 API calls 27554->27556 27557 69758d59 27556->27557 27563 69758d68 27557->27563 27738 697532d7 5 API calls ___ansicp 27557->27738 27559 69758d9e 27739 697533f1 63 API calls _raise 27559->27739 27561 69758da3 27740 697533d9 63 API calls _raise 27561->27740 27563->27559 27566 69758e4c 27563->27566 27564 69758dad 27741 697532d7 5 API calls ___ansicp 27564->27741 27635 697589c4 27566->27635 27568 69758ef2 27569 69758f10 CreateFileA 27568->27569 27570 69758ef9 27568->27570 27572 69758f6c GetFileType 27569->27572 27573 69758f38 27569->27573 27742 697533f1 63 API calls _raise 27570->27742 27574 69758f77 CloseHandle 27572->27574 27575 69758f9b 27572->27575 27577 69758f53 GetLastError 27573->27577 27574->27577 27653 6975874a 27575->27653 27576 69758efe 27743 697533d9 63 API calls _raise 27576->27743 27744 69753409 63 API calls 3 library calls 27577->27744 27584 69758dbc 27628 697593cf LeaveCriticalSection __locking 27584->27628 27626->27544 27627->27547 27628->27547 27630 69758d3e 27629->27630 27631 6975aeea 27629->27631 27630->27554 27737 697532d7 5 API calls ___ansicp 27630->27737 27799 697533d9 63 API calls _raise 27631->27799 27633 6975aeef 27800 697532d7 5 API calls ___ansicp 27633->27800 27636 697589d0 __mtinitlocknum 27635->27636 27637 6975495c __mtinitlocknum 63 API calls 27636->27637 27638 697589e0 27637->27638 27639 69754a24 __mtinitlocknum 63 API calls 27638->27639 27640 697589e5 __mtinitlocknum 27638->27640 27650 697589f4 27639->27650 27640->27568 27641 69758b41 27812 69758b5f LeaveCriticalSection _doexit 27641->27812 27642 69758ad3 27644 69751911 ___crtLCMapStringA 63 API calls 27642->27644 27648 69758adc 27644->27648 27645 69758a76 EnterCriticalSection 27647 69758a86 LeaveCriticalSection 27645->27647 27645->27650 27646 69754a24 __mtinitlocknum 63 API calls 27646->27650 27647->27650 27648->27641 27802 697588f2 27648->27802 27650->27641 27650->27642 27650->27645 27650->27646 27652 697580a8 ___crtInitCritSecAndSpinCount 63 API calls 27650->27652 27801 69758a98 LeaveCriticalSection _doexit 27650->27801 27652->27650 27737->27554 27738->27563 27739->27561 27740->27564 27741->27584 27742->27576 27799->27633 27800->27630 27801->27650 27812->27640 27959 697538f6 EnterCriticalSection 27958->27959 27960 697538de 27958->27960 27959->27408 27960->27959 27961 697538e5 27960->27961 27962 69754a24 __mtinitlocknum 63 API calls 27961->27962 27963 697538f3 27962->27963 27963->27408 27965 697535e0 __fileno 63 API calls 27964->27965 27966 697539aa 27965->27966 27967 6975844d __locking 63 API calls 27966->27967 27969 697539b0 27967->27969 27968 6974f957 27971 6975093c 27968->27971 27969->27968 27970 697540d3 __mtinitlocknum 63 API calls 27969->27970 27970->27968 27972 6975095e _realloc 27971->27972 27975 6974f967 27971->27975 27972->27975 27976 697535e0 __fileno 63 API calls 27972->27976 27977 697570d3 __locking 97 API calls 27972->27977 27988 697524a1 27972->27988 28009 6975364d 27972->28009 27986 69753a33 97 API calls __fclose_nolock 27975->27986 27976->27972 27977->27972 27978->27400 27979->27410 27981 697535ef 27980->27981 27985 6974f8ad 27980->27985 28063 697533d9 63 API calls _raise 27981->28063 27983 697535f4 28064 697532d7 5 API calls ___ansicp 27983->28064 27985->27405 27985->27407 27986->27423 27987->27410 27989 697535e0 __fileno 63 API calls 27988->27989 27990 697524b0 27989->27990 27991 697524d2 27990->27991 27992 697524bb 27990->27992 27994 697524d6 27991->27994 27997 697524e3 27991->27997 28050 697533d9 63 API calls _raise 27992->28050 28051 697533d9 63 API calls _raise 27994->28051 27996 69752534 27998 697525bd 27996->27998 27999 6975253e 27996->27999 27997->27996 28000 69752529 27997->28000 28001 6975844d __locking 63 API calls 27997->28001 28006 697524c0 27997->28006 28002 697570d3 __locking 97 API calls 27998->28002 28003 69752555 27999->28003 28007 69752571 27999->28007 28000->27996 28015 697583f9 28000->28015 28001->28000 28002->28006 28004 697570d3 __locking 97 API calls 28003->28004 28004->28006 28006->27972 28007->28006 28018 697582db 28007->28018 28010 69753666 28009->28010 28014 69753687 28009->28014 28011 697535e0 __fileno 63 API calls 28010->28011 28010->28014 28012 69753680 28011->28012 28013 697570d3 __locking 97 API calls 28012->28013 28013->28014 28014->27972 28016 69751911 ___crtLCMapStringA 63 API calls 28015->28016 28017 69758410 28016->28017 28017->27996 28019 697582e7 __mtinitlocknum 28018->28019 28020 69758314 28019->28020 28021 697582f8 28019->28021 28023 69758322 28020->28023 28025 69758343 28020->28025 28052 697533f1 63 API calls _raise 28021->28052 28054 697533f1 63 API calls _raise 28023->28054 28024 697582fd 28053 697533d9 63 API calls _raise 28024->28053 28027 69758363 28025->28027 28028 69758389 28025->28028 28057 697533f1 63 API calls _raise 28027->28057 28032 697588f2 __locking 64 API calls 28028->28032 28030 69758327 28055 697533d9 63 API calls _raise 28030->28055 28035 6975838f 28032->28035 28034 69758368 28058 697533d9 63 API calls _raise 28034->28058 28038 6975839c 28035->28038 28039 697583b8 28035->28039 28036 6975832e 28056 697532d7 5 API calls ___ansicp 28036->28056 28043 69758251 __lseeki64 65 API calls 28038->28043 28060 697533d9 63 API calls _raise 28039->28060 28041 6975836f 28059 697532d7 5 API calls ___ansicp 28041->28059 28042 69758305 __mtinitlocknum 28042->28006 28046 697583ad 28043->28046 28062 697583ea LeaveCriticalSection __locking 28046->28062 28047 697583bd 28061 697533f1 63 API calls _raise 28047->28061 28050->28006 28051->28006 28052->28024 28053->28042 28054->28030 28055->28036 28056->28042 28057->28034 28058->28041 28059->28042 28060->28047 28061->28046 28062->28042 28063->27983 28064->27985 28066 6974f76c 28065->28066 28067 6974f788 28065->28067 28123 697533d9 63 API calls _raise 28066->28123 28070 6975364d __fclose_nolock 97 API calls 28067->28070 28073 6974f781 28067->28073 28069 6974f771 28124 697532d7 5 API calls ___ansicp 28069->28124 28072 6974f794 28070->28072 28084 69753617 28072->28084 28083 6974f848 LeaveCriticalSection LeaveCriticalSection __fcloseall 28073->28083 28076 697535e0 __fileno 63 API calls 28077 6974f7a2 28076->28077 28088 697534cf 28077->28088 28079 6974f7a8 28079->28073 28125 6975037b 63 API calls 5 library calls 28079->28125 28081->27435 28082->27440 28083->27440 28085 69753627 28084->28085 28087 6974f79c 28084->28087 28085->28087 28126 6975037b 63 API calls 5 library calls 28085->28126 28087->28076 28089 697534db __mtinitlocknum 28088->28089 28090 697534e5 28089->28090 28091 697534ff 28089->28091 28127 697533d9 63 API calls _raise 28090->28127 28093 69753504 28091->28093 28094 69753519 28091->28094 28129 697533f1 63 API calls _raise 28093->28129 28095 69753527 28094->28095 28098 69753548 28094->28098 28131 697533f1 63 API calls _raise 28095->28131 28096 697534ea 28128 697533f1 63 API calls _raise 28096->28128 28104 6975358c 28098->28104 28105 69753568 28098->28105 28101 69753509 28130 697533d9 63 API calls _raise 28101->28130 28102 6975352c 28132 697533d9 63 API calls _raise 28102->28132 28103 697534f5 __mtinitlocknum 28103->28079 28107 697588f2 __locking 64 API calls 28104->28107 28134 697533f1 63 API calls _raise 28105->28134 28110 69753592 28107->28110 28113 697535ad 28110->28113 28114 6975359f 28110->28114 28111 69753533 28133 697532d7 5 API calls ___ansicp 28111->28133 28112 6975356d 28135 697533d9 63 API calls _raise 28112->28135 28137 697533d9 63 API calls _raise 28113->28137 28117 69753431 __fclose_nolock 66 API calls 28114->28117 28120 697535a7 28117->28120 28119 69753574 28136 697532d7 5 API calls ___ansicp 28119->28136 28138 697535d1 LeaveCriticalSection __locking 28120->28138 28123->28069 28124->28073 28125->28073 28126->28087 28127->28096 28128->28103 28129->28101 28130->28103 28131->28102 28132->28111 28133->28103 28134->28112 28135->28119 28136->28103 28137->28120 28138->28103 28139->27446 28141 69746034 28140->28141 28142 6974605a 28141->28142 28174 69745f75 99 API calls _vswprintf_s 28141->28174 28144 6974609f 28142->28144 28145 697460c8 GetWindowsDirectoryA 28144->28145 28164 6974615f 28144->28164 28147 697460ef 28145->28147 28148 697460df OutputDebugStringA 28145->28148 28146 6974fc12 153 API calls 28150 69746171 28146->28150 28175 69746064 28147->28175 28173 697461fa 28148->28173 28150->28148 28153 69746183 28150->28153 28179 6974fb18 28153->28179 28154 6974611b CreateDirectoryA 28157 69746142 28154->28157 28158 6974612e GetLastError 28154->28158 28156 6974fc2e ___ansicp 4 API calls 28160 69746209 28156->28160 28162 69746064 99 API calls 28157->28162 28158->28148 28158->28157 28160->27123 28162->28164 28164->28146 28164->28148 28165 697461c4 28168 69746064 99 API calls 28165->28168 28166 6974619e 28167 69746064 99 API calls 28166->28167 28169 697461bf 28167->28169 28168->28169 28170 6974f855 99 API calls 28169->28170 28171 697461f4 28170->28171 28172 6974f7d4 __fcloseall 102 API calls 28171->28172 28172->28173 28173->28156 28174->28142 28176 69746070 28175->28176 28177 69746097 28176->28177 28185 69745f75 99 API calls _vswprintf_s 28176->28185 28177->28148 28177->28154 28186 6974fa69 28179->28186 28182 6974fa48 28200 6974f9a2 28182->28200 28185->28177 28187 6974faf6 28186->28187 28188 6974fa7c 28186->28188 28198 697533d9 63 API calls _raise 28187->28198 28188->28187 28190 6974fa81 28188->28190 28191 6974fa92 GetLocalTime 28190->28191 28192 6974fa89 28190->28192 28195 6974618c 28191->28195 28197 697533d9 63 API calls _raise 28192->28197 28193 6974fa8e 28199 697532d7 5 API calls ___ansicp 28193->28199 28195->28182 28197->28193 28198->28193 28199->28195 28201 6974f9b5 28200->28201 28202 6974fa26 28200->28202 28201->28202 28203 6974f9ba 28201->28203 28212 697533d9 63 API calls _raise 28202->28212 28205 6974f9c3 28203->28205 28206 6974f9cc GetLocalTime 28203->28206 28211 697533d9 63 API calls _raise 28205->28211 28209 69746195 28206->28209 28207 6974f9c8 28213 697532d7 5 API calls ___ansicp 28207->28213 28209->28165 28209->28166 28211->28207 28212->28207 28213->28209 28215 69747213 GetVersionExA 28214->28215 28216 69747208 28214->28216 28217 69747233 28215->28217 28221 6974724a 28215->28221 28218 6974fc2e ___ansicp 4 API calls 28216->28218 28217->28221 28250 69747089 184 API calls 28217->28250 28219 69747262 28218->28219 28219->27131 28222 697470ae 28219->28222 28221->28216 28223 697470d8 GetVersionExA 28222->28223 28230 697470cd 28222->28230 28224 69747126 28223->28224 28231 697470f8 28223->28231 28229 69747133 28224->28229 28275 69746dab 28224->28275 28226 6974fc2e ___ansicp 4 API calls 28228 69747150 28226->28228 28228->27131 28237 69747157 28228->28237 28287 6974691d 9 API calls ___ansicp 28229->28287 28230->28226 28231->28224 28251 69746eaf 28231->28251 28234 69747138 28234->28230 28238 69747176 28237->28238 28239 69747181 GetVersionExA 28237->28239 28241 6974fc2e ___ansicp 4 API calls 28238->28241 28242 697471a1 28239->28242 28247 697471b8 28239->28247 28240 69746eaf 180 API calls 28243 697471c1 28240->28243 28244 697471e2 28241->28244 28246 69746f9c 180 API calls 28242->28246 28242->28247 28243->28238 28245 697471c5 28243->28245 28244->27131 28342 6974691d 9 API calls ___ansicp 28245->28342 28246->28247 28247->28240 28247->28245 28249 697471ca 28249->28238 28250->28221 28252 69746edc GetSystemDirectoryA 28251->28252 28260 69746ece 28251->28260 28253 69746ef5 28252->28253 28254 69746f5b GetLastError 28252->28254 28288 69746cec 28253->28288 28257 69746f2c 28254->28257 28256 6974fc2e ___ansicp 4 API calls 28258 69746f95 28256->28258 28257->28260 28314 69746391 169 API calls 3 library calls 28257->28314 28258->28224 28263 69746f9c 28258->28263 28260->28256 28261 69746f07 28261->28260 28302 69746872 28261->28302 28264 69746fc9 GetSystemDirectoryA 28263->28264 28265 69746fbb 28263->28265 28266 69746fe2 28264->28266 28267 69747048 GetLastError 28264->28267 28270 6974fc2e ___ansicp 4 API calls 28265->28270 28269 69746cec 171 API calls 28266->28269 28268 69747019 28267->28268 28268->28265 28340 69746391 169 API calls 3 library calls 28268->28340 28273 69746ff4 28269->28273 28272 69747082 28270->28272 28272->28224 28273->28265 28274 69746872 176 API calls 28273->28274 28274->28268 28276 69746dd8 GetSystemDirectoryA 28275->28276 28277 69746dca 28275->28277 28278 69746df1 28276->28278 28279 69746e6e GetLastError 28276->28279 28281 6974fc2e ___ansicp 4 API calls 28277->28281 28280 69746cec 171 API calls 28278->28280 28286 69746e2c 28279->28286 28284 69746e03 28280->28284 28283 69746ea8 28281->28283 28283->28229 28283->28230 28284->28277 28285 69746872 176 API calls 28284->28285 28285->28286 28286->28277 28341 69746391 169 API calls 3 library calls 28286->28341 28287->28234 28289 69746d14 28288->28289 28290 69746d51 28288->28290 28291 69746c43 169 API calls 28289->28291 28293 69746d60 28290->28293 28294 69746d81 FindFirstFileA 28290->28294 28292 69746d1b 28291->28292 28292->28294 28295 69746d1f 28292->28295 28316 69746391 169 API calls 3 library calls 28293->28316 28297 69746d9a FindClose 28294->28297 28299 69746d3c 28294->28299 28315 69746391 169 API calls 3 library calls 28295->28315 28297->28299 28300 6974fc2e ___ansicp 4 API calls 28299->28300 28301 69746d4d 28300->28301 28301->28261 28303 69746887 _memset 28302->28303 28317 697467a1 GetFileVersionInfoSizeA 28303->28317 28305 69746892 28306 6974689c VerQueryValueW 28305->28306 28313 69746898 28305->28313 28313->28257 28314->28260 28315->28299 28316->28299 28318 697467f1 28317->28318 28319 697467bf 28317->28319 28321 6974fc92 63 API calls 28318->28321 28337 697466fb CompareStringA _strrchr 28319->28337 28323 697467f7 28321->28323 28322 697467c5 28324 697467e0 28322->28324 28325 697467c9 GetLastError 28322->28325 28326 6974681e _memset 28323->28326 28327 697467fe 28323->28327 28329 69746210 162 API calls 28324->28329 28328 69746210 162 API calls 28325->28328 28331 69746826 GetFileVersionInfoA 28326->28331 28338 69746391 169 API calls 3 library calls 28327->28338 28334 697467db 28328->28334 28329->28334 28332 69746838 GetLastError 28331->28332 28331->28334 28339 69746391 169 API calls 3 library calls 28332->28339 28334->28305 28337->28322 28338->28334 28339->28334 28340->28265 28341->28277 28342->28249 28344 69747293 GetVersionExA 28343->28344 28345 69747288 28343->28345 28346 697472dd 28344->28346 28349 697472b3 28344->28349 28347 6974fc2e ___ansicp 4 API calls 28345->28347 28346->28345 28348 697472f5 28347->28348 28348->27135 28348->27140 28348->27141 28349->28346 28371 69747089 184 API calls 28349->28371 28352 69746a13 LoadLibraryA 28351->28352 28353 69746a0b 28351->28353 28354 69746ad4 GetLastError 28352->28354 28355 69746a2e GetProcAddress GetProcAddress GetProcAddress 28352->28355 28353->27135 28353->27146 28374 69746391 169 API calls 3 library calls 28354->28374 28356 69746a67 28355->28356 28357 69746a7c GetLastError 28355->28357 28356->28353 28356->28357 28372 69746391 169 API calls 3 library calls 28357->28372 28360 69746aa3 FreeLibrary 28360->28353 28361 69746ab6 GetLastError 28360->28361 28373 69746391 169 API calls 3 library calls 28361->28373 28364 69746b10 FreeLibrary 28363->28364 28365 69746b42 28363->28365 28364->28365 28366 69746b1b GetLastError 28364->28366 28365->27135 28366->28365 28367 69746b25 28366->28367 28375 69746391 169 API calls 3 library calls 28367->28375 28369 69746b3e 28369->27135 28370->27145 28371->28346 28372->28360 28373->28353 28374->28353 28375->28369 28456->27176 28606->27187 28607->27192 28730 69749da3 28727->28730 28728 69749f33 28729 6974fc2e ___ansicp 4 API calls 28728->28729 28731 69749f40 28729->28731 28730->28728 28732 69749e46 28730->28732 28733 69749dec 28730->28733 28746 69749f03 28730->28746 28747 69749d2d 28731->28747 28735 69749e67 28732->28735 28737 69749e4b GetDlgItem SendMessageA 28732->28737 28733->28735 28736 69749df0 GetDlgItem SendMessageA SendMessageA SendMessageA ShowWindow 28733->28736 28734 69749f18 GetDlgItem SendMessageA 28734->28728 28755 69749cd8 171 API calls 28735->28755 28736->28735 28737->28735 28739 69749e86 SetDlgItemTextA 28740 69749ec7 SetDlgItemTextA 28739->28740 28741 69749e9f GetLastError 28739->28741 28743 69749ede GetLastError 28740->28743 28740->28746 28756 69746391 169 API calls 3 library calls 28741->28756 28757 69746391 169 API calls 3 library calls 28743->28757 28744 69749ec4 28744->28740 28746->28728 28746->28734 28748 69749d66 PeekMessageA 28747->28748 28749 69749d74 28748->28749 28750 69749d41 GetMessageA 28748->28750 28749->27304 28749->27305 28749->27306 28750->28748 28751 69749d52 TranslateMessage DispatchMessageA 28750->28751 28751->28748 28752->27298 28755->28739 28756->28744 28757->28746 28776 69748c05 28775->28776 28777 69748c10 GetVersionExA 28775->28777 28779 6974fc2e ___ansicp 4 API calls 28776->28779 28778 69748c47 28777->28778 28780 69748c30 28777->28780 28778->28776 28781 69748c5f 28779->28781 28780->28778 28833 69747089 184 API calls 28780->28833 28781->27343 28781->27345 28784 697488d3 28783->28784 28785 697488de GetVersionExA 28783->28785 28788 6974fc2e ___ansicp 4 API calls 28784->28788 28786 6974892c 28785->28786 28792 697488fe 28785->28792 28792->28786 28836 6974871f GetSystemDefaultLCID 28818->28836 28820 69748753 28821 69748770 28820->28821 28843 697486f0 GetKeyboardType GetKeyboardType 28820->28843 28823 69746210 162 API calls 28821->28823 28825 6974877a 28823->28825 28824 6974875d 28824->28821 28826 69748761 28824->28826 28825->27342 28827 69746210 162 API calls 28826->28827 28828 6974876b 28827->28828 28828->27342 28829->27352 28833->28778 28837 6974872c 28836->28837 28838 6974873b 28836->28838 28839 69746210 162 API calls 28837->28839 28840 69746210 162 API calls 28838->28840 28841 69748736 28839->28841 28842 69748745 28840->28842 28841->28820 28842->28820 28843->28824 30188 69751256 30189 697511eb ___crtInitCritSecAndSpinCount 5 API calls 30188->30189 30190 6975125d 30189->30190 30191 6974f250 30192 6974f351 30191->30192 30193 6974f273 GetVersionExA 30191->30193 30195 6974f357 30192->30195 30196 6974f38c 30192->30196 30194 6974f295 30193->30194 30222 6974f28e 30193->30222 30241 69752139 HeapCreate 30194->30241 30201 6974f376 30195->30201 30195->30222 30351 69751190 30195->30351 30197 6974f391 30196->30197 30198 6974f3dd 30196->30198 30360 697512dd 7 API calls __mtterm 30197->30360 30198->30222 30363 697515f7 75 API calls 2 library calls 30198->30363 30201->30222 30357 69751b96 64 API calls __mtterm 30201->30357 30202 6974fc2e ___ansicp 4 API calls 30207 6974f3f8 30202->30207 30203 6974f396 30208 69751911 ___crtLCMapStringA 63 API calls 30203->30208 30205 6974f2e7 30205->30222 30251 6975166a GetModuleHandleA 30205->30251 30210 6974f3a2 30208->30210 30216 69751264 __mtterm 5 API calls 30210->30216 30210->30222 30212 6974f380 30358 6975130c 66 API calls __mtterm 30212->30358 30214 6974f2f1 30217 6974f2fc GetCommandLineA 30214->30217 30234 6974f2f5 30214->30234 30215 6974f385 30359 6975219e VirtualFree HeapFree HeapFree HeapDestroy 30215->30359 30221 6974f3c0 30216->30221 30285 69751f9b 30217->30285 30226 6974f3c7 30221->30226 30227 6974f3d1 30221->30227 30222->30202 30225 6974f316 30230 6974f31a 30225->30230 30325 69751edb 30225->30325 30361 6975134e 63 API calls 3 library calls 30226->30361 30362 6975037b 63 API calls 5 library calls 30227->30362 30355 6975130c 66 API calls __mtterm 30230->30355 30231 6974f3ce 30231->30222 30354 6975219e VirtualFree HeapFree HeapFree HeapDestroy 30234->30354 30236 6974f33a 30236->30222 30356 69751b96 64 API calls __mtterm 30236->30356 30242 69752161 30241->30242 30243 6975215d 30241->30243 30364 697520d7 63 API calls 3 library calls 30242->30364 30243->30205 30245 69752166 30246 69752194 30245->30246 30247 69752170 30245->30247 30246->30205 30365 69754a5c HeapAlloc 30247->30365 30249 6975217a 30249->30246 30250 6975217f HeapDestroy 30249->30250 30250->30243 30252 69751687 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 30251->30252 30253 6975167e 30251->30253 30255 697516d1 TlsAlloc 30252->30255 30366 6975130c 66 API calls __mtterm 30253->30366 30258 6975177e 30255->30258 30259 6975171b TlsSetValue 30255->30259 30256 69751683 30256->30214 30258->30214 30259->30258 30260 69751728 30259->30260 30367 697511a4 5 API calls 3 library calls 30260->30367 30262 6975172d 30263 697511eb ___crtInitCritSecAndSpinCount 5 API calls 30262->30263 30264 69751738 30263->30264 30265 697511eb ___crtInitCritSecAndSpinCount 5 API calls 30264->30265 30266 69751748 30265->30266 30267 697511eb ___crtInitCritSecAndSpinCount 5 API calls 30266->30267 30268 69751758 30267->30268 30269 697511eb ___crtInitCritSecAndSpinCount 5 API calls 30268->30269 30270 69751768 30269->30270 30368 6975488e 63 API calls 30270->30368 30272 69751775 30273 69751779 30272->30273 30275 69751264 __mtterm 5 API calls 30272->30275 30369 6975130c 66 API calls __mtterm 30273->30369 30276 69751793 30275->30276 30276->30273 30370 6975818b 63 API calls __calloc_impl 30276->30370 30278 697517ac 30278->30273 30279 69751264 __mtterm 5 API calls 30278->30279 30280 697517c6 30279->30280 30281 697517d6 30280->30281 30282 697517cd 30280->30282 30372 6975134e 63 API calls 3 library calls 30281->30372 30371 6975037b 63 API calls 5 library calls 30282->30371 30286 69751fd8 30285->30286 30287 69751fb9 GetEnvironmentStringsW 30285->30287 30288 69751fc1 30286->30288 30290 69752071 30286->30290 30287->30288 30289 69751fcd GetLastError 30287->30289 30292 69751ff4 GetEnvironmentStringsW 30288->30292 30294 69752003 30288->30294 30289->30286 30291 6975207a GetEnvironmentStrings 30290->30291 30295 6974f30c 30290->30295 30291->30295 30296 6975208a 30291->30296 30292->30294 30292->30295 30293 69752018 WideCharToMultiByte 30297 69752037 30293->30297 30298 69752066 FreeEnvironmentStringsW 30293->30298 30294->30293 30294->30294 30310 69751957 30295->30310 30299 697540d3 __mtinitlocknum 63 API calls 30296->30299 30300 697540d3 __mtinitlocknum 63 API calls 30297->30300 30298->30295 30301 697520a4 30299->30301 30302 6975203d 30300->30302 30303 697520b7 _realloc 30301->30303 30304 697520ab FreeEnvironmentStringsA 30301->30304 30302->30298 30305 69752045 WideCharToMultiByte 30302->30305 30308 697520c1 FreeEnvironmentStringsA 30303->30308 30304->30295 30306 69752057 30305->30306 30307 6975205f 30305->30307 30373 6975037b 63 API calls 5 library calls 30306->30373 30307->30298 30308->30295 30374 697522a4 30310->30374 30312 69751963 GetStartupInfoA 30313 69751911 ___crtLCMapStringA 63 API calls 30312->30313 30321 69751984 30313->30321 30314 69751b88 __mtinitlocknum 30314->30225 30315 69751b04 GetStdHandle 30320 69751ace 30315->30320 30316 69751b6a SetHandleCount 30316->30314 30317 69751911 ___crtLCMapStringA 63 API calls 30317->30321 30318 69751b16 GetFileType 30318->30320 30319 69751a50 30319->30314 30319->30320 30322 69751a79 GetFileType 30319->30322 30324 697580a8 ___crtInitCritSecAndSpinCount 63 API calls 30319->30324 30320->30314 30320->30315 30320->30316 30320->30318 30323 697580a8 ___crtInitCritSecAndSpinCount 63 API calls 30320->30323 30321->30314 30321->30317 30321->30319 30321->30320 30322->30319 30323->30320 30324->30319 30326 69751ef5 GetModuleFileNameA 30325->30326 30327 69751ef0 30325->30327 30329 69751f1c 30326->30329 30381 69755c37 106 API calls __setmbcp 30327->30381 30375 69751cf4 30329->30375 30331 6974f326 30331->30236 30336 69751be9 30331->30336 30333 697540d3 __mtinitlocknum 63 API calls 30334 69751f5e 30333->30334 30334->30331 30335 69751cf4 73 API calls 30334->30335 30335->30331 30337 69751bfc 30336->30337 30341 69751c01 30336->30341 30384 69755c37 106 API calls __setmbcp 30337->30384 30339 69751911 ___crtLCMapStringA 63 API calls 30345 69751c4a 30339->30345 30340 6974f32f 30340->30236 30347 69751024 30340->30347 30341->30339 30341->30340 30342 69751cc8 30387 6975037b 63 API calls 5 library calls 30342->30387 30345->30340 30345->30342 30385 69755f98 63 API calls __stricmp_l 30345->30385 30386 697532d7 5 API calls ___ansicp 30345->30386 30349 69751032 30347->30349 30388 69757cbe 30349->30388 30350 69751050 __initterm_e _doexit 30350->30236 30392 697510a2 30351->30392 30353 6975119b 30353->30201 30354->30222 30355->30234 30356->30230 30357->30212 30358->30215 30359->30222 30360->30203 30361->30231 30362->30222 30363->30222 30364->30245 30365->30249 30366->30256 30367->30262 30368->30272 30369->30258 30370->30278 30371->30273 30372->30258 30373->30307 30374->30312 30377 69751d1b 30375->30377 30379 69751d9f 30377->30379 30382 69758234 73 API calls x_ismbbtype_l 30377->30382 30378 69751ebf 30378->30331 30378->30333 30379->30378 30383 69758234 73 API calls x_ismbbtype_l 30379->30383 30381->30326 30382->30377 30383->30379 30384->30341 30385->30345 30386->30345 30387->30340 30389 69757cc4 30388->30389 30390 697511eb ___crtInitCritSecAndSpinCount 5 API calls 30389->30390 30391 69757cdc 30389->30391 30390->30389 30391->30350 30393 697510ae __mtinitlocknum 30392->30393 30394 69754a24 __mtinitlocknum 63 API calls 30393->30394 30395 697510b5 30394->30395 30397 69751264 __mtterm 5 API calls 30395->30397 30407 697510f1 _doexit 30395->30407 30399 697510e4 30397->30399 30398 6975113c 30400 69751142 30398->30400 30401 6975116a __mtinitlocknum 30398->30401 30402 69751264 __mtterm 5 API calls 30399->30402 30409 69754940 LeaveCriticalSection 30400->30409 30401->30353 30402->30407 30404 6975114f 30410 69750f5e GetModuleHandleA GetProcAddress ExitProcess ___crtCorExitProcess 30404->30410 30408 6975115b LeaveCriticalSection _doexit 30407->30408 30408->30398 30409->30404 31726 6974f54f 5 API calls __mtinitlocknum 31727 6974d948 31728 6974d94f 31727->31728 31729 6974d96b 31728->31729 31730 69746210 162 API calls 31728->31730 31757 69746391 169 API calls 3 library calls 31729->31757 31732 6974d98e 31730->31732 31733 69747269 185 API calls 31732->31733 31734 6974d995 31733->31734 31735 6974d99d CreateFileA 31734->31735 31739 6974dabd 31734->31739 31737 6974da96 GetLastError 31735->31737 31738 6974d9bf GetFileTime 31735->31738 31736 6974dae9 31742 6974fc2e ___ansicp 4 API calls 31736->31742 31737->31729 31740 6974d9ef LocalFileTimeToFileTime 31738->31740 31741 6974da4b GetLastError 31738->31741 31739->31736 31745 6974da91 31739->31745 31743 6974da35 GetLastError 31740->31743 31744 6974da07 SetFileTime 31740->31744 31746 6974da5f 31741->31746 31747 6974e3ae 31742->31747 31743->31746 31748 6974da20 GetLastError 31744->31748 31749 6974da68 CloseHandle 31744->31749 31745->31739 31758 6974b8f8 199 API calls _strrchr 31745->31758 31755 69746391 169 API calls 3 library calls 31746->31755 31748->31746 31749->31739 31753 6974da78 GetLastError 31749->31753 31752 6974da65 31752->31749 31756 69746391 169 API calls 3 library calls 31753->31756 31755->31752 31756->31745 31757->31739 31758->31736 29851 a8a9ff 29852 a8aa0c 29851->29852 29857 a8e40d 29852->29857 29855 a8e40d ___crtLCMapStringA 62 API calls 29856 a8aa3f 29855->29856 29864 a8e2ea 29857->29864 29859 a8e427 29863 a8aa26 29859->29863 29877 a8a553 62 API calls __getptd 29859->29877 29861 a8e43d 29861->29863 29878 a8a553 62 API calls __getptd 29861->29878 29863->29855 29863->29856 29865 a8e2f6 _doexit 29864->29865 29866 a8e30e 29865->29866 29874 a8e32d _memset 29865->29874 29879 a8a553 62 API calls __getptd 29866->29879 29868 a8e313 29880 a8a451 5 API calls __cftof_l 29868->29880 29870 a8e39f RtlAllocateHeap 29870->29874 29873 a8e323 _doexit 29873->29859 29874->29870 29874->29873 29881 a8db61 29874->29881 29888 a8ea09 5 API calls 2 library calls 29874->29888 29889 a8e3e6 LeaveCriticalSection _doexit 29874->29889 29890 a8b542 5 API calls _doexit 29874->29890 29877->29861 29878->29863 29879->29868 29880->29873 29882 a8db89 EnterCriticalSection 29881->29882 29883 a8db76 29881->29883 29882->29874 29891 a8da99 29883->29891 29885 a8db7c 29885->29882 29920 a87ec6 62 API calls 3 library calls 29885->29920 29887 a8db88 29887->29882 29888->29874 29889->29874 29890->29874 29892 a8daa5 _doexit 29891->29892 29893 a8dacd 29892->29893 29894 a8dab5 29892->29894 29900 a8dadb _doexit 29893->29900 29926 a8b45f 29893->29926 29921 a8836a 62 API calls 2 library calls 29894->29921 29896 a8daba 29922 a881e0 62 API calls 3 library calls 29896->29922 29900->29885 29901 a8dac1 29923 a87f24 29901->29923 29902 a8dafc 29904 a8db61 _doexit 62 API calls 29902->29904 29903 a8daed 29944 a8a553 62 API calls __getptd 29903->29944 29907 a8db03 29904->29907 29909 a8db0b 29907->29909 29910 a8db37 29907->29910 29945 a8df24 62 API calls 4 library calls 29909->29945 29948 a8a5ab 62 API calls 4 library calls 29910->29948 29913 a8db16 29915 a8db28 29913->29915 29946 a8a5ab 62 API calls 4 library calls 29913->29946 29914 a8db3d 29949 a8db53 LeaveCriticalSection _doexit 29914->29949 29915->29914 29918 a8db22 29947 a8a553 62 API calls __getptd 29918->29947 29920->29887 29921->29896 29922->29901 29950 a87ef4 GetModuleHandleA 29923->29950 29927 a8b512 29926->29927 29937 a8b471 29926->29937 29960 a8b542 5 API calls _doexit 29927->29960 29929 a8b518 29961 a8a553 62 API calls __getptd 29929->29961 29934 a8b4ce RtlAllocateHeap 29934->29937 29935 a8b482 29936 a87f24 _doexit 3 API calls 29935->29936 29935->29937 29954 a8836a 62 API calls 2 library calls 29935->29954 29955 a881e0 62 API calls 3 library calls 29935->29955 29936->29935 29937->29934 29937->29935 29938 a8b4fe 29937->29938 29941 a8b503 29937->29941 29943 a8b50a 29937->29943 29956 a8b40b 62 API calls 3 library calls 29937->29956 29957 a8b542 5 API calls _doexit 29937->29957 29958 a8a553 62 API calls __getptd 29938->29958 29959 a8a553 62 API calls __getptd 29941->29959 29943->29902 29943->29903 29944->29900 29945->29913 29946->29918 29947->29915 29948->29914 29949->29900 29951 a87f08 GetProcAddress 29950->29951 29952 a87f1d ExitProcess 29950->29952 29951->29952 29953 a87f18 29951->29953 29953->29952 29954->29935 29955->29935 29956->29937 29957->29937 29958->29941 29959->29943 29960->29929 29961->29943 30411 6c09c16c 30412 6c09c179 30411->30412 30413 6c09813a ___crtLCMapStringA 63 API calls 30412->30413 30414 6c09c193 30413->30414 30415 6c09813a ___crtLCMapStringA 63 API calls 30414->30415 30416 6c09c1ac 30414->30416 30415->30416 30429 6974f41c 214 API calls __mtinitlocknum 30431 a86ec2 30432 a86ed1 ___crtLCMapStringA 30431->30432 30473 a8935e GetModuleHandleA 30432->30473 30434 a86edc GetStartupInfoA GetVersionExA 30435 a87036 30434->30435 30437 a86f19 30434->30437 30693 a893e8 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess __cftof_l 30435->30693 30475 a89296 HeapCreate 30437->30475 30440 a86f7a 30441 a86f86 30440->30441 30686 a86e4e 62 API calls 3 library calls 30440->30686 30485 a890b0 GetModuleHandleA 30441->30485 30444 a86f8c 30447 a86f97 30444->30447 30687 a86e4e 62 API calls 3 library calls 30444->30687 30519 a88a65 30447->30519 30448 a86fa0 30449 a86fac GetCommandLineA 30448->30449 30688 a87ec6 62 API calls 3 library calls 30448->30688 30536 a88929 30449->30536 30453 a86fab 30453->30449 30456 a86fd1 30573 a88577 30456->30573 30460 a86fe2 30584 a87fea 30460->30584 30463 a86fe9 30464 a86ff4 30463->30464 30691 a87ec6 62 API calls 3 library calls 30463->30691 30588 a88513 30464->30588 30474 a8936f 30473->30474 30474->30434 30476 a892ba 30475->30476 30477 a892be 30475->30477 30476->30440 30694 a89234 62 API calls 3 library calls 30477->30694 30479 a892c3 30480 a892cd 30479->30480 30481 a892f1 30479->30481 30695 a8e4a4 HeapAlloc 30480->30695 30481->30440 30483 a892d7 30483->30481 30484 a892dc HeapDestroy 30483->30484 30484->30476 30486 a890cd GetProcAddress GetProcAddress GetProcAddress GetProcAddress 30485->30486 30487 a890c4 30485->30487 30489 a89117 TlsAlloc 30486->30489 30696 a88dc5 65 API calls 2 library calls 30487->30696 30492 a89161 TlsSetValue 30489->30492 30493 a891c4 30489->30493 30490 a890c9 30490->30444 30492->30493 30494 a8916e 30492->30494 30493->30444 30697 a88199 5 API calls 3 library calls 30494->30697 30496 a89173 30497 a88ca4 ___crtInitCritSecAndSpinCount 5 API calls 30496->30497 30498 a8917e 30497->30498 30499 a88ca4 ___crtInitCritSecAndSpinCount 5 API calls 30498->30499 30500 a8918e 30499->30500 30501 a88ca4 ___crtInitCritSecAndSpinCount 5 API calls 30500->30501 30502 a8919e 30501->30502 30503 a88ca4 ___crtInitCritSecAndSpinCount 5 API calls 30502->30503 30504 a891ae 30503->30504 30698 a8d9cb 62 API calls 30504->30698 30506 a891bb 30507 a891bf 30506->30507 30700 a88d1d TlsGetValue 30506->30700 30699 a88dc5 65 API calls 2 library calls 30507->30699 30512 a891f2 30512->30507 30513 a88d1d _doexit 5 API calls 30512->30513 30514 a8920c 30513->30514 30515 a8921c 30514->30515 30516 a89213 30514->30516 30711 a88e07 62 API calls 3 library calls 30515->30711 30710 a8a5ab 62 API calls 4 library calls 30516->30710 30712 a8aba8 30519->30712 30521 a88a71 GetStartupInfoA 30522 a8e40d ___crtLCMapStringA 62 API calls 30521->30522 30528 a88a92 30522->30528 30523 a88c96 _doexit 30523->30448 30524 a88c12 GetStdHandle 30530 a88bdc 30524->30530 30525 a88c78 SetHandleCount 30525->30523 30526 a8e40d ___crtLCMapStringA 62 API calls 30526->30528 30527 a88c24 GetFileType 30527->30530 30528->30523 30528->30526 30529 a88b5e 30528->30529 30528->30530 30529->30530 30532 a88b92 30529->30532 30533 a88b87 GetFileType 30529->30533 30530->30524 30530->30525 30530->30527 30534 a88c3b 30530->30534 30532->30523 30532->30529 30713 a8df24 62 API calls 4 library calls 30532->30713 30533->30529 30533->30532 30534->30523 30534->30530 30714 a8df24 62 API calls 4 library calls 30534->30714 30537 a88966 30536->30537 30538 a88947 GetEnvironmentStringsW 30536->30538 30540 a8894f 30537->30540 30541 a889ff 30537->30541 30539 a8895b GetLastError 30538->30539 30538->30540 30539->30537 30542 a88982 GetEnvironmentStringsW 30540->30542 30549 a88991 WideCharToMultiByte 30540->30549 30543 a88a08 GetEnvironmentStrings 30541->30543 30547 a86fbc 30541->30547 30542->30547 30542->30549 30543->30547 30548 a88a18 30543->30548 30545 a889f4 FreeEnvironmentStringsW 30545->30547 30546 a889c5 30551 a8b45f ___crtGetEnvironmentStringsA 62 API calls 30546->30551 30562 a88869 30547->30562 30548->30548 30550 a8b45f ___crtGetEnvironmentStringsA 62 API calls 30548->30550 30549->30545 30549->30546 30552 a88a32 30550->30552 30553 a889cb 30551->30553 30554 a88a39 FreeEnvironmentStringsA 30552->30554 30555 a88a45 30552->30555 30553->30545 30556 a889d3 WideCharToMultiByte 30553->30556 30554->30547 30716 a8b730 __VEC_memcpy 30555->30716 30558 a889ed 30556->30558 30559 a889e5 30556->30559 30558->30545 30715 a8a5ab 62 API calls 4 library calls 30559->30715 30560 a88a4f FreeEnvironmentStringsA 30560->30547 30563 a8887e 30562->30563 30564 a88883 GetModuleFileNameA 30562->30564 30723 a8c140 105 API calls __setmbcp 30563->30723 30566 a888aa 30564->30566 30717 a88682 30566->30717 30568 a86fc6 30568->30456 30689 a87ec6 62 API calls 3 library calls 30568->30689 30570 a8b45f ___crtGetEnvironmentStringsA 62 API calls 30571 a888ec 30570->30571 30571->30568 30572 a88682 72 API calls 30571->30572 30572->30568 30574 a8858a 30573->30574 30577 a8858f 30573->30577 30726 a8c140 105 API calls __setmbcp 30574->30726 30576 a8e40d ___crtLCMapStringA 62 API calls 30582 a885d8 30576->30582 30577->30576 30577->30577 30578 a86fd7 30577->30578 30578->30460 30690 a87ec6 62 API calls 3 library calls 30578->30690 30579 a88656 30729 a8a5ab 62 API calls 4 library calls 30579->30729 30582->30578 30582->30579 30727 a8c4a1 62 API calls 2 library calls 30582->30727 30728 a8a451 5 API calls __cftof_l 30582->30728 30586 a87ff8 30584->30586 30730 a8db99 30586->30730 30587 a88016 __initterm_e _doexit 30587->30463 30589 a88521 30588->30589 30591 a88526 30588->30591 30734 a8c140 105 API calls __setmbcp 30589->30734 30592 a86ffa 30591->30592 30735 a8e2cd 72 API calls x_ismbbtype_l 30591->30735 30594 a84d57 CreateMutexA 30592->30594 30595 a85159 EnumWindows 30594->30595 30596 a84d79 GetLastError 30594->30596 30686->30441 30687->30447 30688->30453 30689->30456 30690->30460 30691->30464 30694->30479 30695->30483 30696->30490 30697->30496 30698->30506 30699->30493 30701 a88d35 30700->30701 30702 a88d56 GetModuleHandleA 30700->30702 30701->30702 30703 a88d3f TlsGetValue 30701->30703 30704 a88d7d 30702->30704 30705 a88d65 GetProcAddress 30702->30705 30707 a88d4a 30703->30707 30704->30507 30709 a8e453 62 API calls __calloc_impl 30704->30709 30706 a88d4e 30705->30706 30706->30704 30708 a88d75 RtlDecodePointer 30706->30708 30707->30702 30707->30706 30708->30704 30709->30512 30710->30507 30711->30493 30712->30521 30713->30532 30714->30534 30715->30558 30716->30560 30719 a886a9 30717->30719 30722 a8872d 30719->30722 30724 a8e2cd 72 API calls x_ismbbtype_l 30719->30724 30720 a8884d 30720->30568 30720->30570 30722->30720 30725 a8e2cd 72 API calls x_ismbbtype_l 30722->30725 30723->30564 30724->30719 30725->30722 30726->30577 30727->30582 30728->30582 30729->30578 30731 a8db9f 30730->30731 30732 a88ca4 ___crtInitCritSecAndSpinCount 5 API calls 30731->30732 30733 a8dbb7 30731->30733 30732->30731 30733->30587 30734->30591 30735->30591 31759 6c096975 185 API calls __calloc_impl 26812 697537f2 26813 697537ff 26812->26813 26818 69751911 26813->26818 26816 69751911 ___crtLCMapStringA 63 API calls 26817 69753832 26816->26817 26825 697517ee 26818->26825 26820 6975194a 26820->26816 26820->26817 26821 6975192b 26821->26820 26838 697533d9 63 API calls _raise 26821->26838 26823 69751941 26823->26820 26839 697533d9 63 API calls _raise 26823->26839 26826 697517fa __mtinitlocknum 26825->26826 26827 69751812 26826->26827 26837 69751831 _memset 26826->26837 26840 697533d9 63 API calls _raise 26827->26840 26829 69751817 26841 697532d7 5 API calls ___ansicp 26829->26841 26831 697518a3 RtlAllocateHeap 26831->26837 26834 69751827 __mtinitlocknum 26834->26821 26837->26831 26837->26834 26842 69754a24 26837->26842 26849 697552a7 5 API calls 2 library calls 26837->26849 26850 697518ea LeaveCriticalSection _doexit 26837->26850 26851 697541b6 5 API calls __mtterm 26837->26851 26838->26823 26839->26820 26840->26829 26841->26834 26843 69754a4c EnterCriticalSection 26842->26843 26844 69754a39 26842->26844 26843->26837 26852 6975495c 26844->26852 26846 69754a3f 26846->26843 26880 69750f00 63 API calls 3 library calls 26846->26880 26848 69754a4b 26848->26843 26849->26837 26850->26837 26851->26837 26853 69754968 __mtinitlocknum 26852->26853 26854 69754990 26853->26854 26855 69754978 26853->26855 26863 6975499e __mtinitlocknum 26854->26863 26881 697540d3 26854->26881 26912 69757c80 63 API calls 2 library calls 26855->26912 26858 6975497d 26913 69757af6 63 API calls 3 library calls 26858->26913 26861 697549b0 26915 697533d9 63 API calls _raise 26861->26915 26862 697549bf 26866 69754a24 __mtinitlocknum 63 API calls 26862->26866 26863->26846 26864 69754984 26914 69750f5e GetModuleHandleA GetProcAddress ExitProcess ___crtCorExitProcess 26864->26914 26868 697549c6 26866->26868 26870 697549ce 26868->26870 26871 697549fa 26868->26871 26899 697580a8 26870->26899 26918 6975037b 63 API calls 5 library calls 26871->26918 26874 697549eb 26919 69754a16 LeaveCriticalSection _doexit 26874->26919 26875 697549d9 26875->26874 26916 6975037b 63 API calls 5 library calls 26875->26916 26878 697549e5 26917 697533d9 63 API calls _raise 26878->26917 26880->26848 26882 69754186 26881->26882 26893 697540e5 26881->26893 26927 697541b6 5 API calls __mtterm 26882->26927 26884 6975418c 26928 697533d9 63 API calls _raise 26884->26928 26887 6975417e 26887->26861 26887->26862 26890 69754142 RtlAllocateHeap 26890->26893 26891 697540f6 26891->26893 26920 69757c80 63 API calls 2 library calls 26891->26920 26921 69757af6 63 API calls 3 library calls 26891->26921 26922 69750f5e GetModuleHandleA GetProcAddress ExitProcess ___crtCorExitProcess 26891->26922 26893->26887 26893->26890 26893->26891 26894 69754172 26893->26894 26897 69754177 26893->26897 26923 6975407f 63 API calls 2 library calls 26893->26923 26924 697541b6 5 API calls __mtterm 26893->26924 26925 697533d9 63 API calls _raise 26894->26925 26926 697533d9 63 API calls _raise 26897->26926 26900 697580b4 __mtinitlocknum 26899->26900 26929 69751264 TlsGetValue 26900->26929 26905 69758118 __mtinitlocknum 26905->26875 26906 697580e3 26908 6975810d 26906->26908 26909 697580ec GetModuleHandleW 26906->26909 26945 697511eb TlsGetValue 26908->26945 26909->26908 26910 697580fb GetProcAddress 26909->26910 26910->26908 26912->26858 26913->26864 26915->26863 26916->26878 26917->26874 26918->26874 26919->26863 26920->26891 26921->26891 26923->26893 26924->26893 26925->26897 26926->26887 26927->26884 26928->26887 26930 6975129d GetModuleHandleA 26929->26930 26931 6975127c 26929->26931 26932 697512c4 26930->26932 26933 697512ac GetProcAddress 26930->26933 26931->26930 26934 69751286 TlsGetValue 26931->26934 26932->26905 26938 69750f9d 26932->26938 26935 69751295 26933->26935 26936 69751291 26934->26936 26935->26932 26937 697512bc RtlDecodePointer 26935->26937 26936->26930 26936->26935 26937->26932 26939 69750fac 26938->26939 26941 69750fc1 26939->26941 26954 697533d9 63 API calls _raise 26939->26954 26941->26906 26944 697532d7 5 API calls ___ansicp 26941->26944 26942 69750fb1 26955 697532d7 5 API calls ___ansicp 26942->26955 26944->26906 26946 69751224 GetModuleHandleA 26945->26946 26947 69751203 26945->26947 26948 69751233 GetProcAddress 26946->26948 26949 6975124b 26946->26949 26947->26946 26950 6975120d TlsGetValue 26947->26950 26951 6975121c 26948->26951 26949->26905 26953 69751218 26950->26953 26951->26949 26952 69751243 RtlEncodePointer 26951->26952 26952->26949 26953->26946 26953->26951 26954->26942 26955->26941 28872 6c094f9c 28886 6c096383 28872->28886 28875 6c094fce GetLastError 28876 6c095012 28875->28876 28877 6c094fdb 28875->28877 28878 6c095019 CloseHandle 28876->28878 28879 6c09504c 28876->28879 28893 6c094b10 28877->28893 28878->28879 28880 6c095024 GetLastError 28878->28880 28935 6c0964d5 169 API calls 3 library calls 28880->28935 28884 6c095049 28884->28879 28885 6c094ffe iDirectXSetup 28885->28876 28936 6c0961d6 28886->28936 28892 6c094fb6 CreateMutexA 28892->28875 28892->28876 28894 6c094c93 28893->28894 28895 6c094b36 GetCurrentDirectoryW 28893->28895 28896 6c094ced 28894->28896 28897 6c094cb7 GetProcAddress 28894->28897 28898 6c094b78 GetModuleFileNameW 28895->28898 28899 6c094b4d GetLastError 28895->28899 28901 6c094d2b 28896->28901 28902 6c094cf5 GetProcAddress 28896->28902 28897->28896 28900 6c094ccd GetLastError 28897->28900 28904 6c094ba9 28898->28904 28905 6c094b90 GetLastError 28898->28905 28903 6c094b64 28899->28903 28900->28896 28908 6c094d71 28901->28908 28909 6c094d33 GetProcAddress 28901->28909 28902->28901 28906 6c094d0b GetLastError 28902->28906 29849 6c0964d5 169 API calls 3 library calls 28903->29849 28904->28894 28914 6c094bc1 SetCurrentDirectoryW 28904->28914 28905->28903 28906->28901 28910 6c094d79 GetProcAddress 28908->28910 28911 6c094daf 28908->28911 28912 6c094d69 28909->28912 28913 6c094d49 GetLastError 28909->28913 28910->28911 28915 6c094d8f GetLastError 28910->28915 28916 6c094ded 28911->28916 28917 6c094db7 GetProcAddress 28911->28917 28912->28908 28913->28912 28919 6c094bd9 GetLastError 28914->28919 28920 6c094bf5 28914->28920 28915->28911 28922 6c094e2b 28916->28922 28923 6c094df5 GetProcAddress 28916->28923 28917->28916 28921 6c094dcd GetLastError 28917->28921 28918 6c094b6e 28924 6c096df2 ___ansicp 4 API calls 28918->28924 28919->28903 28929 6c094c3a LoadLibraryW SetCurrentDirectoryW 28920->28929 28930 6c094c11 28920->28930 28921->28916 28922->28918 28926 6c094e33 GetProcAddress 28922->28926 28923->28922 28925 6c094e0b GetLastError 28923->28925 28927 6c094e79 28924->28927 28925->28922 28926->28918 28928 6c094e49 GetLastError 28926->28928 28927->28876 28927->28885 28928->28918 28932 6c094c6f 28929->28932 28933 6c094c53 GetLastError 28929->28933 29850 6c0964d5 169 API calls 3 library calls 28930->29850 28932->28894 28934 6c094c77 GetLastError 28932->28934 28933->28932 28934->28894 28935->28884 28937 6c0961e2 28936->28937 28938 6c096208 28937->28938 28974 6c09618b 99 API calls _vswprintf_s 28937->28974 28940 6c096212 28938->28940 28941 6c09623b GetWindowsDirectoryA 28940->28941 28960 6c0962d2 28940->28960 28943 6c096262 28941->28943 28957 6c096252 OutputDebugStringA 28941->28957 28975 6c094a54 28943->28975 28947 6c0962f6 28982 6c09747f 28947->28982 28950 6c096df2 ___ansicp 4 API calls 28953 6c09637c 28950->28953 28951 6c09628e CreateDirectoryA 28954 6c0962a1 GetLastError 28951->28954 28955 6c0962b5 28951->28955 28970 6c096df2 28953->28970 28954->28955 28954->28957 28958 6c094a54 99 API calls 28955->28958 28969 6c09636d 28957->28969 28958->28960 28960->28957 28979 6c097579 28960->28979 28961 6c096311 28963 6c094a54 99 API calls 28961->28963 28962 6c096337 28964 6c094a54 99 API calls 28962->28964 28965 6c096332 28963->28965 28964->28965 28988 6c0971bc 28965->28988 28967 6c096367 29021 6c09713b 28967->29021 28969->28950 28971 6c096dfa 28970->28971 28972 6c096dfc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 28970->28972 28971->28892 28972->28892 28974->28938 28976 6c094a62 28975->28976 28978 6c094a8c 28976->28978 29034 6c096cd5 99 API calls _vswprintf_s 28976->29034 28978->28951 28978->28957 29035 6c0974a0 28979->29035 28981 6c0962e4 28981->28947 28981->28957 29628 6c0973d0 28982->29628 28985 6c0973af 29642 6c097309 28985->29642 28990 6c0971c8 __calloc_impl 28988->28990 28989 6c0971d6 29676 6c099c85 63 API calls _raise 28989->29676 28990->28989 28992 6c09729c 28990->28992 29678 6c09bf5a 28990->29678 29656 6c09c247 28992->29656 28993 6c0971db 29677 6c099b83 5 API calls ___ansicp 28993->29677 28998 6c09723c 28998->28989 29004 6c09bf5a __fileno 63 API calls 28998->29004 28999 6c0972b4 29662 6c09c315 28999->29662 29000 6c09bf5a __fileno 63 API calls 29002 6c097220 29000->29002 29002->28998 29008 6c09bf5a __fileno 63 API calls 29002->29008 29003 6c0971eb __calloc_impl 29003->28967 29006 6c097259 29004->29006 29009 6c097281 29006->29009 29012 6c09bf5a __fileno 63 API calls 29006->29012 29011 6c09722c 29008->29011 29009->28989 29009->28992 29014 6c09bf5a __fileno 63 API calls 29011->29014 29015 6c097265 29012->29015 29014->28998 29015->29009 29018 6c09bf5a __fileno 63 API calls 29015->29018 29016 6c0972d8 29685 6c0972fc LeaveCriticalSection LeaveCriticalSection __fcloseall 29016->29685 29019 6c097271 29018->29019 29020 6c09bf5a __fileno 63 API calls 29019->29020 29020->29009 29022 6c097147 __calloc_impl 29021->29022 29023 6c097178 29022->29023 29024 6c09715b 29022->29024 29026 6c09c247 __fcloseall 64 API calls 29023->29026 29032 6c097170 __calloc_impl 29023->29032 29791 6c099c85 63 API calls _raise 29024->29791 29028 6c097190 29026->29028 29027 6c097160 29792 6c099b83 5 API calls ___ansicp 29027->29792 29775 6c0970bf 29028->29775 29032->28969 29034->28978 29036 6c0974ac __calloc_impl 29035->29036 29037 6c0974bf 29036->29037 29038 6c0974d1 29036->29038 29097 6c099c85 63 API calls _raise 29037->29097 29040 6c0974df 29038->29040 29041 6c097504 29038->29041 29098 6c099c85 63 API calls _raise 29040->29098 29057 6c09c7ad 29041->29057 29044 6c0974e4 29099 6c099b83 5 API calls ___ansicp 29044->29099 29045 6c097509 29047 6c09751d 29045->29047 29048 6c097510 29045->29048 29050 6c097544 29047->29050 29051 6c097524 29047->29051 29100 6c099c85 63 API calls _raise 29048->29100 29075 6c09c506 29050->29075 29101 6c099c85 63 API calls _raise 29051->29101 29054 6c0974c4 __calloc_impl @_EH4_CallFilterFunc@8 29054->28981 29058 6c09c7b9 __calloc_impl 29057->29058 29103 6c09add9 29058->29103 29060 6c09c834 29138 6c09c8ca 29060->29138 29061 6c09c838 29143 6c09b6f5 29061->29143 29064 6c09c8bf __calloc_impl 29064->29045 29069 6c09c7c7 29069->29060 29069->29061 29110 6c09ad11 29069->29110 29141 6c09c281 64 API calls __calloc_impl 29069->29141 29142 6c09c2e8 LeaveCriticalSection LeaveCriticalSection _doexit 29069->29142 29070 6c09c867 29072 6c09c872 29070->29072 29073 6c09c885 EnterCriticalSection 29070->29073 29174 6c096f02 63 API calls 4 library calls 29072->29174 29073->29060 29076 6c09c528 29075->29076 29077 6c09c53c 29076->29077 29085 6c09c55b 29076->29085 29224 6c099c85 63 API calls _raise 29077->29224 29079 6c09c541 29225 6c099b83 5 API calls ___ansicp 29079->29225 29081 6c09c761 29221 6c09feb1 29081->29221 29082 6c09c747 29230 6c099c85 63 API calls _raise 29082->29230 29085->29082 29096 6c09c6f7 29085->29096 29226 6c0a0283 73 API calls __fassign 29085->29226 29086 6c09c74c 29231 6c099b83 5 API calls ___ansicp 29086->29231 29087 6c09754f 29102 6c09756a LeaveCriticalSection LeaveCriticalSection __fcloseall 29087->29102 29090 6c09c6dc 29090->29082 29227 6c0a00f7 98 API calls 29090->29227 29092 6c09c6f1 29092->29096 29228 6c0a00f7 98 API calls 29092->29228 29094 6c09c70e 29094->29096 29229 6c0a00f7 98 API calls 29094->29229 29096->29081 29096->29082 29097->29054 29098->29044 29099->29054 29100->29054 29101->29054 29102->29054 29104 6c09adee 29103->29104 29105 6c09ae01 EnterCriticalSection 29103->29105 29106 6c09ad11 __mtinitlocknum 62 API calls 29104->29106 29105->29069 29107 6c09adf4 29106->29107 29107->29105 29175 6c097729 63 API calls 2 library calls 29107->29175 29109 6c09ae00 29109->29105 29111 6c09ad1d __calloc_impl 29110->29111 29112 6c09ad2d 29111->29112 29113 6c09ad45 29111->29113 29176 6c09cbba 63 API calls 2 library calls 29112->29176 29116 6c09b6f5 __setmbcp 63 API calls 29113->29116 29121 6c09ad53 __calloc_impl 29113->29121 29115 6c09ad32 29177 6c09ca30 63 API calls 3 library calls 29115->29177 29118 6c09ad5e 29116->29118 29119 6c09ad65 29118->29119 29120 6c09ad74 29118->29120 29179 6c099c85 63 API calls _raise 29119->29179 29124 6c09add9 __calloc_impl 63 API calls 29120->29124 29121->29069 29122 6c09ad39 29178 6c097787 GetModuleHandleA GetProcAddress ExitProcess ___crtCorExitProcess 29122->29178 29126 6c09ad7b 29124->29126 29128 6c09adaf 29126->29128 29129 6c09ad83 29126->29129 29182 6c096f02 63 API calls 4 library calls 29128->29182 29131 6c09cfd8 ___crtInitCritSecAndSpinCount 63 API calls 29129->29131 29133 6c09ad8e 29131->29133 29132 6c09ada0 29183 6c09adcb LeaveCriticalSection _doexit 29132->29183 29133->29132 29180 6c096f02 63 API calls 4 library calls 29133->29180 29136 6c09ad9a 29181 6c099c85 63 API calls _raise 29136->29181 29184 6c09acf5 LeaveCriticalSection 29138->29184 29140 6c09c8d1 29140->29064 29141->29069 29142->29069 29144 6c09b7a8 29143->29144 29154 6c09b707 29143->29154 29192 6c09b674 5 API calls __mtterm 29144->29192 29146 6c09b7ae 29193 6c099c85 63 API calls _raise 29146->29193 29151 6c09b764 HeapAlloc 29151->29154 29152 6c09b718 29152->29151 29152->29154 29185 6c09cbba 63 API calls 2 library calls 29152->29185 29186 6c09ca30 63 API calls 3 library calls 29152->29186 29187 6c097787 GetModuleHandleA GetProcAddress ExitProcess ___crtCorExitProcess 29152->29187 29154->29152 29155 6c09b794 29154->29155 29158 6c09b799 29154->29158 29160 6c09b7a0 29154->29160 29188 6c09b6a1 63 API calls 2 library calls 29154->29188 29189 6c09b674 5 API calls __mtterm 29154->29189 29190 6c099c85 63 API calls _raise 29155->29190 29191 6c099c85 63 API calls _raise 29158->29191 29160->29060 29161 6c09cfd8 29160->29161 29162 6c09cfe4 __calloc_impl 29161->29162 29194 6c097a8d TlsGetValue 29162->29194 29168 6c09d03d 29210 6c097a14 TlsGetValue 29168->29210 29169 6c09d01c GetModuleHandleW 29169->29168 29172 6c09d02b GetProcAddress 29169->29172 29170 6c09d048 __calloc_impl 29170->29070 29171 6c09d013 29171->29168 29171->29169 29172->29168 29174->29060 29175->29109 29176->29115 29177->29122 29179->29121 29180->29136 29181->29132 29182->29132 29183->29121 29184->29140 29185->29152 29186->29152 29188->29154 29189->29154 29190->29158 29191->29160 29192->29146 29193->29160 29195 6c097aa5 29194->29195 29196 6c097ac6 GetModuleHandleA 29194->29196 29195->29196 29197 6c097aaf TlsGetValue 29195->29197 29198 6c097aed 29196->29198 29199 6c097ad5 GetProcAddress 29196->29199 29201 6c097aba 29197->29201 29198->29170 29203 6c0977c6 29198->29203 29200 6c097abe 29199->29200 29200->29198 29202 6c097ae5 RtlDecodePointer 29200->29202 29201->29196 29201->29200 29202->29198 29204 6c0977d5 29203->29204 29206 6c0977ea 29204->29206 29219 6c099c85 63 API calls _raise 29204->29219 29206->29171 29209 6c099b83 5 API calls ___ansicp 29206->29209 29207 6c0977da 29220 6c099b83 5 API calls ___ansicp 29207->29220 29209->29171 29211 6c097a4d GetModuleHandleA 29210->29211 29212 6c097a2c 29210->29212 29214 6c097a5c GetProcAddress 29211->29214 29215 6c097a74 29211->29215 29212->29211 29213 6c097a36 TlsGetValue 29212->29213 29216 6c097a41 29213->29216 29218 6c097a45 29214->29218 29215->29170 29216->29211 29216->29218 29217 6c097a6c RtlEncodePointer 29217->29215 29218->29215 29218->29217 29219->29207 29220->29206 29232 6c09fdf4 29221->29232 29223 6c09fecc 29223->29087 29224->29079 29225->29087 29226->29090 29227->29092 29228->29094 29229->29096 29230->29086 29231->29087 29234 6c09fe00 __calloc_impl 29232->29234 29233 6c09fe0c 29319 6c099c85 63 API calls _raise 29233->29319 29234->29233 29237 6c09fe3d 29234->29237 29236 6c09fe11 29320 6c099b83 5 API calls ___ansicp 29236->29320 29243 6c09f7a6 29237->29243 29242 6c09fe20 __calloc_impl 29242->29223 29244 6c09f7d1 29243->29244 29322 6c0a1d71 29244->29322 29247 6c09f7fc 29248 6c0977c6 __get_wpgmptr 63 API calls 29247->29248 29250 6c09f808 29248->29250 29256 6c09f817 29250->29256 29431 6c099b83 5 API calls ___ansicp 29250->29431 29252 6c09f84d 29432 6c099c9d 63 API calls _raise 29252->29432 29254 6c09f852 29433 6c099c85 63 API calls _raise 29254->29433 29256->29252 29259 6c09f8fb 29256->29259 29257 6c09f85c 29434 6c099b83 5 API calls ___ansicp 29257->29434 29328 6c09f473 29259->29328 29261 6c09f9a1 29262 6c09f9a8 29261->29262 29263 6c09f9bf CreateFileA 29261->29263 29435 6c099c9d 63 API calls _raise 29262->29435 29265 6c09fa1b GetFileType 29263->29265 29266 6c09f9e7 29263->29266 29269 6c09fa4a 29265->29269 29270 6c09fa26 CloseHandle 29265->29270 29268 6c09fa02 GetLastError 29266->29268 29267 6c09f9ad 29436 6c099c85 63 API calls _raise 29267->29436 29437 6c099cb5 63 API calls 3 library calls 29268->29437 29346 6c09f1f9 29269->29346 29270->29268 29277 6c09f86b 29321 6c09fe7e LeaveCriticalSection __locking 29277->29321 29293 6c09f9b7 29438 6c099c85 63 API calls _raise 29293->29438 29319->29236 29320->29242 29321->29242 29323 6c09f7ed 29322->29323 29324 6c0a1d80 29322->29324 29323->29247 29430 6c099b83 5 API calls ___ansicp 29323->29430 29492 6c099c85 63 API calls _raise 29324->29492 29326 6c0a1d85 29493 6c099b83 5 API calls ___ansicp 29326->29493 29329 6c09f47f __calloc_impl 29328->29329 29330 6c09ad11 __mtinitlocknum 63 API calls 29329->29330 29331 6c09f48f 29330->29331 29332 6c09add9 __calloc_impl 63 API calls 29331->29332 29333 6c09f494 __calloc_impl 29331->29333 29337 6c09f4a3 29332->29337 29333->29261 29335 6c09f582 29495 6c09813a 29335->29495 29337->29335 29338 6c09f525 EnterCriticalSection 29337->29338 29339 6c09add9 __calloc_impl 63 API calls 29337->29339 29344 6c09f5f0 29337->29344 29345 6c09cfd8 ___crtInitCritSecAndSpinCount 63 API calls 29337->29345 29494 6c09f547 LeaveCriticalSection _doexit 29337->29494 29338->29337 29341 6c09f535 LeaveCriticalSection 29338->29341 29339->29337 29341->29337 29512 6c09f60e LeaveCriticalSection _doexit 29344->29512 29345->29337 29347 6c09f260 29346->29347 29348 6c09f207 29346->29348 29513 6c099c85 63 API calls _raise 29347->29513 29348->29347 29351 6c09f22b 29348->29351 29430->29247 29431->29256 29432->29254 29433->29257 29434->29277 29435->29267 29436->29293 29437->29293 29438->29277 29492->29326 29493->29323 29494->29337 29496 6c098017 __calloc_impl 63 API calls 29495->29496 29497 6c098154 29496->29497 29498 6c099c85 __calloc_impl 63 API calls 29497->29498 29501 6c098173 29497->29501 29499 6c09816a 29498->29499 29499->29501 29501->29344 29502 6c09f3a1 29501->29502 29512->29333 29629 6c09745d 29628->29629 29630 6c0973e3 29628->29630 29640 6c099c85 63 API calls _raise 29629->29640 29630->29629 29632 6c0973e8 29630->29632 29633 6c0973f9 GetLocalTime 29632->29633 29634 6c0973f0 29632->29634 29635 6c0962ff 29633->29635 29639 6c099c85 63 API calls _raise 29634->29639 29635->28985 29636 6c0973f5 29641 6c099b83 5 API calls ___ansicp 29636->29641 29639->29636 29640->29636 29641->29635 29643 6c09738d 29642->29643 29644 6c09731c 29642->29644 29654 6c099c85 63 API calls _raise 29643->29654 29644->29643 29645 6c097321 29644->29645 29647 6c09732a 29645->29647 29648 6c097333 GetLocalTime 29645->29648 29653 6c099c85 63 API calls _raise 29647->29653 29651 6c096308 29648->29651 29649 6c09732f 29655 6c099b83 5 API calls ___ansicp 29649->29655 29651->28961 29651->28962 29653->29649 29654->29649 29655->29651 29657 6c09c258 29656->29657 29658 6c09c270 EnterCriticalSection 29656->29658 29657->29658 29659 6c09c25f 29657->29659 29658->28999 29660 6c09add9 __calloc_impl 63 API calls 29659->29660 29661 6c09c26d 29660->29661 29661->28999 29663 6c09bf5a __fileno 63 API calls 29662->29663 29664 6c09c324 29663->29664 29686 6c09e5b3 29664->29686 29666 6c0972be 29669 6c09c3e5 29666->29669 29667 6c09c32a 29667->29666 29668 6c09b6f5 __setmbcp 63 API calls 29667->29668 29668->29666 29671 6c0972ce 29669->29671 29672 6c09c407 ___crtGetEnvironmentStringsA 29669->29672 29684 6c09c3ad 97 API calls __fclose_nolock 29671->29684 29672->29671 29674 6c09bf5a __fileno 63 API calls 29672->29674 29675 6c09e47e __locking 97 API calls 29672->29675 29698 6c098cc1 29672->29698 29719 6c09bfc7 29672->29719 29674->29672 29675->29672 29676->28993 29677->29003 29679 6c09bf69 29678->29679 29680 6c097214 29678->29680 29773 6c099c85 63 API calls _raise 29679->29773 29680->28998 29680->29000 29682 6c09bf6e 29774 6c099b83 5 API calls ___ansicp 29682->29774 29684->29016 29685->29003 29687 6c09e5cf 29686->29687 29688 6c09e5c0 29686->29688 29691 6c09e5f3 29687->29691 29696 6c099c85 63 API calls _raise 29687->29696 29695 6c099c85 63 API calls _raise 29688->29695 29690 6c09e5c5 29690->29667 29691->29667 29693 6c09e5e3 29697 6c099b83 5 API calls ___ansicp 29693->29697 29695->29690 29696->29693 29697->29691 29699 6c09bf5a __fileno 63 API calls 29698->29699 29700 6c098cd0 29699->29700 29701 6c098cdb 29700->29701 29702 6c098cf2 29700->29702 29760 6c099c85 63 API calls _raise 29701->29760 29704 6c098cf6 29702->29704 29707 6c098d03 29702->29707 29761 6c099c85 63 API calls _raise 29704->29761 29706 6c098ce0 29706->29672 29707->29706 29710 6c09e5b3 __locking 63 API calls 29707->29710 29714 6c098d49 29707->29714 29717 6c098d54 29707->29717 29708 6c098ddd 29711 6c09e47e __locking 97 API calls 29708->29711 29709 6c098d5e 29712 6c098d75 29709->29712 29713 6c098d91 29709->29713 29710->29714 29711->29706 29716 6c09e47e __locking 97 API calls 29712->29716 29713->29706 29728 6c09dc7f 29713->29728 29714->29717 29725 6c09e55f 29714->29725 29716->29706 29717->29708 29717->29709 29720 6c09c001 29719->29720 29721 6c09bfe0 29719->29721 29720->29672 29721->29720 29722 6c09bf5a __fileno 63 API calls 29721->29722 29723 6c09bffa 29722->29723 29724 6c09e47e __locking 97 API calls 29723->29724 29724->29720 29726 6c09813a ___crtLCMapStringA 63 API calls 29725->29726 29727 6c09e576 29726->29727 29727->29717 29760->29706 29761->29706 29773->29682 29774->29680 29776 6c0970ef 29775->29776 29777 6c0970d3 29775->29777 29780 6c09bfc7 __fclose_nolock 97 API calls 29776->29780 29789 6c0970e8 29776->29789 29833 6c099c85 63 API calls _raise 29777->29833 29779 6c0970d8 29834 6c099b83 5 API calls ___ansicp 29779->29834 29782 6c0970fb 29780->29782 29794 6c09bf91 29782->29794 29785 6c09bf5a __fileno 63 API calls 29786 6c097109 29785->29786 29798 6c09be49 29786->29798 29793 6c0971af LeaveCriticalSection LeaveCriticalSection __fcloseall 29789->29793 29791->29027 29792->29032 29793->29032 29795 6c097103 29794->29795 29796 6c09bfa1 29794->29796 29795->29785 29796->29795 29836 6c096f02 63 API calls 4 library calls 29796->29836 29799 6c09be55 __calloc_impl 29798->29799 29800 6c09be79 29799->29800 29801 6c09be5f 29799->29801 29803 6c09be7e 29800->29803 29804 6c09be93 29800->29804 29837 6c099c85 63 API calls _raise 29801->29837 29833->29779 29834->29789 29836->29795 29849->28918 29850->28918 29963 6c0967a9 29964 6c0968aa 29963->29964 29965 6c0967cc GetVersionExA 29963->29965 29966 6c0968b0 29964->29966 29967 6c0968e5 29964->29967 29968 6c0967ee 29965->29968 29995 6c0967e7 29965->29995 29976 6c0968cf 29966->29976 29966->29995 30123 6c0979b9 29966->30123 29969 6c0968ea 29967->29969 29970 6c096936 29967->29970 30013 6c098962 HeapCreate 29968->30013 30126 6c097b06 TlsGetValue 29969->30126 29970->29995 30139 6c097e20 75 API calls 2 library calls 29970->30139 29972 6c096df2 ___ansicp 4 API calls 29975 6c096951 29972->29975 29976->29995 30134 6c0983bf 64 API calls __mtterm 29976->30134 29979 6c09813a ___crtLCMapStringA 63 API calls 29982 6c0968fb 29979->29982 29980 6c096840 29980->29995 30023 6c097e93 GetModuleHandleA 29980->30023 29987 6c097a8d __mtterm 5 API calls 29982->29987 29982->29995 29984 6c0968d9 30135 6c097b35 66 API calls __mtterm 29984->30135 29985 6c09684a 29988 6c09684e 29985->29988 29989 6c096855 GetCommandLineA 29985->29989 29991 6c096919 29987->29991 30131 6c0989c7 VirtualFree HeapFree HeapFree HeapDestroy 29988->30131 30057 6c0987c4 29989->30057 29990 6c0968de 30136 6c0989c7 VirtualFree HeapFree HeapFree HeapDestroy 29990->30136 29998 6c09692a 29991->29998 29999 6c096920 29991->29999 29995->29972 30138 6c096f02 63 API calls 4 library calls 29998->30138 30137 6c097b77 63 API calls 3 library calls 29999->30137 30000 6c09686f 30003 6c096873 30000->30003 30097 6c098704 30000->30097 30132 6c097b35 66 API calls __mtterm 30003->30132 30006 6c096927 30006->29995 30008 6c096893 30008->29995 30133 6c0983bf 64 API calls __mtterm 30008->30133 30014 6c09898a 30013->30014 30015 6c098986 30013->30015 30140 6c098900 63 API calls 3 library calls 30014->30140 30015->29980 30017 6c09898f 30018 6c098999 30017->30018 30019 6c0989bd 30017->30019 30141 6c09ae11 HeapAlloc 30018->30141 30019->29980 30021 6c0989a3 30021->30019 30022 6c0989a8 HeapDestroy 30021->30022 30022->30015 30024 6c097eb0 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 30023->30024 30025 6c097ea7 30023->30025 30027 6c097efa TlsAlloc 30024->30027 30142 6c097b35 66 API calls __mtterm 30025->30142 30030 6c097f44 TlsSetValue 30027->30030 30056 6c097fa7 30027->30056 30029 6c097eac 30029->29985 30031 6c097f51 30030->30031 30030->30056 30143 6c0979cd 5 API calls 3 library calls 30031->30143 30033 6c097f56 30034 6c097a14 ___crtInitCritSecAndSpinCount 5 API calls 30033->30034 30035 6c097f61 30034->30035 30036 6c097a14 ___crtInitCritSecAndSpinCount 5 API calls 30035->30036 30037 6c097f71 30036->30037 30038 6c097a14 ___crtInitCritSecAndSpinCount 5 API calls 30037->30038 30039 6c097f81 30038->30039 30040 6c097a14 ___crtInitCritSecAndSpinCount 5 API calls 30039->30040 30041 6c097f91 30040->30041 30144 6c09ac43 63 API calls 30041->30144 30043 6c097f9e 30044 6c097fa2 30043->30044 30046 6c097a8d __mtterm 5 API calls 30043->30046 30145 6c097b35 66 API calls __mtterm 30044->30145 30047 6c097fbc 30046->30047 30047->30044 30146 6c09dac2 63 API calls __calloc_impl 30047->30146 30049 6c097fd5 30049->30044 30050 6c097a8d __mtterm 5 API calls 30049->30050 30051 6c097fef 30050->30051 30052 6c097fff 30051->30052 30053 6c097ff6 30051->30053 30148 6c097b77 63 API calls 3 library calls 30052->30148 30147 6c096f02 63 API calls 4 library calls 30053->30147 30056->29985 30058 6c098801 30057->30058 30059 6c0987e2 GetEnvironmentStringsW 30057->30059 30060 6c0987ea 30058->30060 30061 6c09889a 30058->30061 30059->30060 30062 6c0987f6 GetLastError 30059->30062 30063 6c09881d GetEnvironmentStringsW 30060->30063 30068 6c09882c 30060->30068 30064 6c0988a3 GetEnvironmentStrings 30061->30064 30065 6c096865 30061->30065 30062->30058 30063->30065 30063->30068 30064->30065 30066 6c0988b3 30064->30066 30082 6c098180 30065->30082 30071 6c09b6f5 __setmbcp 63 API calls 30066->30071 30067 6c098841 WideCharToMultiByte 30069 6c09888f FreeEnvironmentStringsW 30067->30069 30070 6c098860 30067->30070 30068->30067 30068->30068 30069->30065 30072 6c09b6f5 __setmbcp 63 API calls 30070->30072 30073 6c0988cd 30071->30073 30074 6c098866 30072->30074 30075 6c0988e0 ___crtGetEnvironmentStringsA 30073->30075 30076 6c0988d4 FreeEnvironmentStringsA 30073->30076 30074->30069 30077 6c09886e WideCharToMultiByte 30074->30077 30080 6c0988ea FreeEnvironmentStringsA 30075->30080 30076->30065 30078 6c098888 30077->30078 30079 6c098880 30077->30079 30078->30069 30149 6c096f02 63 API calls 4 library calls 30079->30149 30080->30065 30150 6c098acc 30082->30150 30084 6c09818c GetStartupInfoA 30085 6c09813a ___crtLCMapStringA 63 API calls 30084->30085 30093 6c0981ad 30085->30093 30086 6c0983b1 __calloc_impl 30086->30000 30087 6c09832d GetStdHandle 30092 6c0982f7 30087->30092 30088 6c098393 SetHandleCount 30088->30086 30089 6c09813a ___crtLCMapStringA 63 API calls 30089->30093 30090 6c09833f GetFileType 30090->30092 30091 6c098279 30091->30086 30091->30092 30094 6c0982a2 GetFileType 30091->30094 30096 6c09cfd8 ___crtInitCritSecAndSpinCount 63 API calls 30091->30096 30092->30086 30092->30087 30092->30088 30092->30090 30095 6c09cfd8 ___crtInitCritSecAndSpinCount 63 API calls 30092->30095 30093->30086 30093->30089 30093->30091 30093->30092 30094->30091 30095->30092 30096->30091 30098 6c098719 30097->30098 30099 6c09871e GetModuleFileNameA 30097->30099 30157 6c09da9f 106 API calls __setmbcp 30098->30157 30101 6c098745 30099->30101 30151 6c09851d 30101->30151 30103 6c09687f 30103->30008 30108 6c098412 30103->30108 30105 6c09b6f5 __setmbcp 63 API calls 30106 6c098787 30105->30106 30106->30103 30107 6c09851d 73 API calls 30106->30107 30107->30103 30109 6c098425 30108->30109 30112 6c09842a 30108->30112 30160 6c09da9f 106 API calls __setmbcp 30109->30160 30111 6c09813a ___crtLCMapStringA 63 API calls 30117 6c098473 30111->30117 30112->30111 30113 6c096888 30112->30113 30113->30008 30119 6c09784d 30113->30119 30114 6c0984f1 30163 6c096f02 63 API calls 4 library calls 30114->30163 30117->30113 30117->30114 30161 6c09db13 63 API calls __calloc_impl 30117->30161 30162 6c099b83 5 API calls ___ansicp 30117->30162 30121 6c09785b 30119->30121 30164 6c09cbf8 30121->30164 30122 6c097879 __initterm_e _doexit 30122->30008 30168 6c0978cb 30123->30168 30125 6c0979c4 30125->29976 30127 6c0968ef 30126->30127 30128 6c097b16 30126->30128 30127->29979 30129 6c097a8d __mtterm 5 API calls 30128->30129 30130 6c097b21 TlsSetValue 30129->30130 30130->30127 30131->29995 30132->29988 30133->30003 30134->29984 30135->29990 30136->29995 30137->30006 30138->29995 30139->29995 30140->30017 30141->30021 30142->30029 30143->30033 30144->30043 30145->30056 30146->30049 30147->30044 30148->30056 30149->30078 30150->30084 30155 6c098544 30151->30155 30153 6c0985c8 30154 6c0986e8 30153->30154 30159 6c09dbd8 73 API calls x_ismbbtype_l 30153->30159 30154->30103 30154->30105 30155->30153 30158 6c09dbd8 73 API calls x_ismbbtype_l 30155->30158 30157->30099 30158->30155 30159->30153 30160->30112 30161->30117 30162->30117 30163->30113 30165 6c09cbfe 30164->30165 30166 6c097a14 ___crtInitCritSecAndSpinCount 5 API calls 30165->30166 30167 6c09cc16 30165->30167 30166->30165 30167->30122 30169 6c0978d7 __calloc_impl 30168->30169 30170 6c09add9 __calloc_impl 63 API calls 30169->30170 30171 6c0978de 30170->30171 30173 6c097a8d __mtterm 5 API calls 30171->30173 30180 6c09791a _doexit 30171->30180 30175 6c09790d 30173->30175 30174 6c097965 30176 6c09796b 30174->30176 30177 6c097993 __calloc_impl 30174->30177 30178 6c097a8d __mtterm 5 API calls 30175->30178 30185 6c09acf5 LeaveCriticalSection 30176->30185 30177->30125 30178->30180 30184 6c097984 LeaveCriticalSection _doexit 30180->30184 30181 6c097978 30186 6c097787 GetModuleHandleA GetProcAddress ExitProcess ___crtCorExitProcess 30181->30186 30184->30174 30185->30181 30417 a88d0f 30420 a88ca4 TlsGetValue 30417->30420 30421 a88cbc 30420->30421 30422 a88cdd GetModuleHandleA 30420->30422 30421->30422 30425 a88cc6 TlsGetValue 30421->30425 30423 a88cec GetProcAddress 30422->30423 30424 a88d04 30422->30424 30426 a88cd5 30423->30426 30428 a88cd1 30425->30428 30426->30424 30427 a88cfc RtlEncodePointer 30426->30427 30427->30424 30428->30422 30428->30426 31644 6974e3b5 196 API calls 2 library calls 31713 6974f4c1 31714 6974f4cc 31713->31714 31715 6974e72a 209 API calls 31714->31715 31716 6974f43f __mtinitlocknum 31714->31716 31717 6974f4f1 31715->31717 31719 6974e72a 209 API calls 31717->31719 31722 6974f56b 31717->31722 31718 6974f401 5 API calls 31718->31716 31720 6974f539 31719->31720 31721 6974f401 5 API calls 31720->31721 31721->31722 31722->31716 31722->31718 28844 6974f5b9 28845 6974f5c4 28844->28845 28847 6974f5e8 __mtinitlocknum 28845->28847 28848 6974f401 28845->28848 28849 6974f411 28848->28849 28850 6974f40c 28848->28850 28852 69752217 GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 28850->28852 28852->28849 28855 6c0969dd 28856 6c0969c4 28855->28856 28864 6c096998 __calloc_impl 28856->28864 28867 6c09695a 28856->28867 28868 6c09696a 28867->28868 28869 6c096965 28867->28869 28871 6c098a40 GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 28869->28871 28871->28868 31645 6974f484 31646 6974f46b 31645->31646 31647 6974f401 5 API calls 31646->31647 31649 6974f43f __mtinitlocknum 31646->31649 31648 6974f4ab 31647->31648 31648->31649 31657 6974e72a 31648->31657 31652 6974f401 5 API calls 31652->31649 31653 6974e72a 209 API calls 31654 6974f539 31653->31654 31655 6974f401 5 API calls 31654->31655 31656 6974f56b 31655->31656 31656->31649 31656->31652 31658 6974e7ee OutputDebugStringA 31657->31658 31659 6974e73f 31657->31659 31661 6974e808 31658->31661 31676 6974e77c 31658->31676 31660 6974e746 OutputDebugStringA 31659->31660 31659->31676 31662 6974e759 31660->31662 31660->31676 31663 6974e810 CloseHandle 31661->31663 31661->31676 31664 6974fc92 63 API calls 31662->31664 31665 6974e825 GetLastError 31663->31665 31666 6974e843 31663->31666 31669 6974e763 31664->31669 31705 69746391 169 API calls 3 library calls 31665->31705 31671 6974e7e9 31666->31671 31706 6974e698 172 API calls __mtterm 31666->31706 31670 6974e76f 31669->31670 31679 6974b021 31669->31679 31673 6974e783 CreateMutexA 31670->31673 31670->31676 31671->31676 31674 6974e796 GetLastError 31673->31674 31673->31676 31675 6974e7c4 CloseHandle 31674->31675 31674->31676 31675->31676 31677 6974e7cf GetLastError 31675->31677 31676->31653 31676->31656 31704 69746391 169 API calls 3 library calls 31677->31704 31680 697471e9 185 API calls 31679->31680 31681 6974b041 31680->31681 31682 697470ae 190 API calls 31681->31682 31685 6974b045 31681->31685 31683 6974b068 31682->31683 31684 69747157 188 API calls 31683->31684 31683->31685 31684->31685 31686 6974b0ac GetWindowsDirectoryA 31685->31686 31687 6974b166 GetLastError 31686->31687 31688 6974b18f 31686->31688 31707 69746391 169 API calls 3 library calls 31687->31707 31690 697485ae CharNextA 31688->31690 31692 6974b19b 31690->31692 31691 6974b187 31694 6974b1ca GetSystemDirectoryA 31691->31694 31693 6974a078 CharNextA 31692->31693 31695 6974b1a8 31693->31695 31696 6974b205 31694->31696 31697 6974b1dc GetLastError 31694->31697 31695->31694 31708 69746391 169 API calls 3 library calls 31695->31708 31698 6974a078 CharNextA 31696->31698 31709 69746391 169 API calls 3 library calls 31697->31709 31701 6974b212 31698->31701 31702 6974b1fd 31701->31702 31710 69746391 169 API calls 3 library calls 31701->31710 31702->31670 31704->31671 31705->31666 31706->31671 31707->31691 31708->31691 31709->31702 31710->31702

                                                                                                                              Executed Functions

                                                                                                                              Function 00A84D57 Relevance: 72.1, APIs: 22, Strings: 19, Instructions: 303libraryloaderkeyboardCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 275 a84d57-a84d73 CreateMutexA 276 a85159-a85167 EnumWindows 275->276 277 a84d79-a84d84 GetLastError 275->277 280 a85168-a8516a 276->280 278 a84d8a-a84da3 call a84b1b 277->278 279 a85150-a85153 CloseHandle 277->279 283 a84dcf-a84dda call a84c60 278->283 284 a84da5-a84dcd call a8390a call a847af 278->284 279->276 290 a84eb0 283->290 291 a84de0-a84de2 283->291 298 a84e11-a84e18 284->298 293 a84eb2-a84eb9 290->293 294 a84e1d-a84e24 call a8422e 291->294 295 a84de4-a84de6 291->295 299 a84ebb-a84ecb call a847af 293->299 300 a84ecc-a84ecf 293->300 307 a84e5d-a84e64 call a83c3f 294->307 308 a84e26-a84e4a call a8390a 294->308 295->294 296 a84de8-a84e0e call a8390a call a847af 295->296 296->298 302 a85141-a8514e CloseHandle 298->302 299->300 300->302 302->280 315 a84e88-a84e90 call a83f72 307->315 316 a84e66-a84e86 call a8390a 307->316 317 a84e4c-a84e53 call a847af 308->317 318 a84e54-a84e58 308->318 325 a84e92-a84ead call a8390a 315->325 326 a84ed4-a84efe SetErrorMode LoadLibraryA SetErrorMode 315->326 316->293 317->318 318->302 325->290 327 a85110-a85134 GetLastError call a8390a call a8495a 326->327 328 a84f04-a84f41 GetProcAddress * 3 326->328 340 a85139 327->340 330 a850b4-a850ec GetLastError call a8390a FreeLibrary 328->330 331 a84f47-a84f4f 328->331 330->340 341 a850ee-a850f6 GetLastError 330->341 331->330 335 a84f55-a84f57 331->335 335->330 338 a84f5d-a84f6c 335->338 345 a84f79-a84f7f 338->345 346 a84f6e-a84f74 338->346 342 a85140 340->342 341->340 344 a850f8-a8510e call a8390a 341->344 342->302 344->340 349 a85005-a85008 345->349 350 a84f85-a84f9f DirectXSetupA call a84090 345->350 346->345 348 a84f76 346->348 348->345 352 a8509a-a850a7 DirectXSetupA 349->352 353 a8500e-a85011 349->353 358 a84fe0-a84fe3 350->358 359 a84fa1-a84fb4 call a847af GetAsyncKeyState 350->359 355 a850aa call a84090 352->355 353->352 356 a85017-a8501d 353->356 363 a850af 355->363 356->352 361 a8501f-a85021 356->361 366 a84fef-a84ffa call a847af 358->366 367 a84fe5-a84fea call a8495a 358->367 376 a84fc2-a84fdb call a837b8 call a84163 ExitWindowsEx 359->376 377 a84fb6-a84fc0 call a837b8 359->377 364 a85023-a85030 #17 361->364 365 a85077-a85095 call a8390a 361->365 363->342 371 a8506d-a85075 call a86964 364->371 372 a85032-a8503b FreeLibrary 364->372 365->342 374 a84fff-a85000 366->374 367->342 371->355 378 a8503d-a85045 GetLastError 372->378 379 a85067 372->379 374->342 376->342 377->374 378->379 384 a85047-a85065 call a8390a 378->384 379->371 384->371
                                                                                                                              APIs
                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,DirectX Setup), ref: 00A84D68
                                                                                                                              • GetLastError.KERNEL32 ref: 00A84D79
                                                                                                                              • SetErrorMode.KERNELBASE(00008001), ref: 00A84EE0
                                                                                                                              • LoadLibraryA.KERNEL32(dsetup.dll), ref: 00A84EE9
                                                                                                                              • SetErrorMode.KERNELBASE(00000000), ref: 00A84EF5
                                                                                                                              • GetProcAddress.KERNEL32(6C090000,DirectXSetupA), ref: 00A84F10
                                                                                                                              • GetProcAddress.KERNEL32(DirectXSetupSetCallback), ref: 00A84F22
                                                                                                                              • GetProcAddress.KERNEL32(DirectXSetupShowEULA), ref: 00A84F34
                                                                                                                              • DirectXSetupA.DSETUP(00000000,00000000,02010098), ref: 00A84F8C
                                                                                                                              • ExitWindowsEx.USER32(00000002,00000000), ref: 00A84FD5
                                                                                                                              • GetAsyncKeyState.USER32 ref: 00A84FAB
                                                                                                                                • Part of subcall function 00A8390A: GetLastError.KERNEL32 ref: 00A83AC7
                                                                                                                                • Part of subcall function 00A84163: GetCurrentProcess.KERNEL32 ref: 00A84176
                                                                                                                                • Part of subcall function 00A84163: OpenProcessToken.ADVAPI32(00000000,000F01FF,?), ref: 00A84186
                                                                                                                                • Part of subcall function 00A84163: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00A8419C
                                                                                                                                • Part of subcall function 00A84163: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00A841CB
                                                                                                                                • Part of subcall function 00A84163: CloseHandle.KERNEL32(?), ref: 00A841D4
                                                                                                                                • Part of subcall function 00A84163: FreeLibrary.KERNEL32(6C090000), ref: 00A841E4
                                                                                                                                • Part of subcall function 00A84163: GetLastError.KERNEL32 ref: 00A841EE
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00A85144
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                                • Part of subcall function 00A847AF: LoadStringW.USER32(00000064,?,00000104), ref: 00A847F5
                                                                                                                                • Part of subcall function 00A847AF: GetLastError.KERNEL32(00000000), ref: 00A8480C
                                                                                                                                • Part of subcall function 00A847AF: LoadStringW.USER32(?,?,00000104), ref: 00A84858
                                                                                                                                • Part of subcall function 00A847AF: GetLastError.KERNEL32(String ID: %d,?), ref: 00A8486A
                                                                                                                                • Part of subcall function 00A8422E: GetVersionExA.KERNEL32(?), ref: 00A84254
                                                                                                                                • Part of subcall function 00A8390A: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00A83A9A
                                                                                                                                • Part of subcall function 00A8390A: LocalFree.KERNEL32(?), ref: 00A83ABF
                                                                                                                                • Part of subcall function 00A847AF: LoadStringW.USER32(0000006F,?,00000104), ref: 00A848A6
                                                                                                                                • Part of subcall function 00A847AF: GetLastError.KERNEL32(String ID: %d,0000006F), ref: 00A848B7
                                                                                                                                • Part of subcall function 00A847AF: ___swprintf_l.LIBCMT ref: 00A8491E
                                                                                                                                • Part of subcall function 00A847AF: MessageBoxW.USER32 ref: 00A84940
                                                                                                                                • Part of subcall function 00A83F72: RegCreateKeyExA.KERNEL32(80000002,Software\Microsoft\DirectX,00000000,00000000,00000000,00000002,00000000,?,00000000), ref: 00A83F98
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00A85153
                                                                                                                              • EnumWindows.USER32(Function_00004288,00000000), ref: 00A8515F
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Error$Last$Load$AddressCloseHandleProcString$CreateFreeLibraryMessageModeProcessTokenWindows__wstrtime$AdjustAsyncCurrentDirectEnumExitFormatLocalLookupMutexOpenPrivilegePrivilegesSetupStateValueVersion___swprintf_l_strrchr
                                                                                                                              • String ID: Current logon user doesn't have the Administrator privilege.$DirectX Setup$DirectXSetupA$DirectXSetupSetCallback$DirectXSetupShowEULA$FreeLibrary()$GetProcAddress()$Invalid command line switch, using command ID %d without flat image.$Invalid command line switch.$LoadLibrary()$Module: dsetup.dll$SetDXSetupRegValue() failed.$This version of DirectX is not compatible with WindowsNT 4.0.$Unknown install command.$User did not reboot$User rebooted$WinMain$dsetup.dll$e:\bt\382730\setup\deliverables\dxsetup\dxsetup.cpp
                                                                                                                              • API String ID: 1300868845-2194485137
                                                                                                                              • Opcode ID: 2734ebbd28fb3888407d40248e4cecbf483fa38fd91311284bf8f41dfa91058e
                                                                                                                              • Instruction ID: 201ca3c280a8b3a79941bd106465896a978c919213e467ca67c6ecebab469e6f
                                                                                                                              • Opcode Fuzzy Hash: 2734ebbd28fb3888407d40248e4cecbf483fa38fd91311284bf8f41dfa91058e
                                                                                                                              • Instruction Fuzzy Hash: 34915A72E80705BBDB20BBF99C0ED6B397DBB94F51B100B1AF914A11D1EB604D438BA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A83647 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 114COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 717 a83647-a8366a 718 a8370e-a8371f call a87642 717->718 719 a83670-a83685 GetWindowsDirectoryA 717->719 727 a8372b-a83744 call a87548 call a87478 718->727 728 a83721-a83726 718->728 721 a83697-a836ba call a8360c 719->721 722 a83687 719->722 730 a836bc-a836c1 721->730 731 a836c3-a836d4 CreateDirectoryA 721->731 724 a8368c-a83692 OutputDebugStringA 722->724 729 a837a5-a837b2 call a8765e 724->729 743 a8376c-a8378c call a8360c 727->743 744 a83746-a8376a call a8360c 727->744 728->724 730->724 734 a836ea-a8370c call a8360c 731->734 735 a836d6-a836e1 GetLastError 731->735 734->718 734->730 735->734 738 a836e3-a836e8 735->738 738->724 749 a8378f-a8379d call a87285 call a87204 743->749 744->749 753 a837a2 749->753 753->729
                                                                                                                              APIs
                                                                                                                              • GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A8367D
                                                                                                                              • OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.), ref: 00A8368C
                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000), ref: 00A836CC
                                                                                                                              • GetLastError.KERNEL32 ref: 00A836D6
                                                                                                                              • __wstrtime.LIBCMT ref: 00A8372F
                                                                                                                              • __wstrtime.LIBCMT ref: 00A83738
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Directory__wstrtime$CreateDebugErrorLastOutputStringWindows
                                                                                                                              • String ID: %s %s: %s: %s$%s %s: %s: (null)$%s%s$%s%s%s$C:\Windows\Logs\DirectX.log$DXSETUP_DPF(): GetWindowsDirectory() failed.$DXSETUP_DPF(): Unable to open log file.$DXSETUP_DPF(): failed to create log directory.$DXSETUP_DPF(): path name too long.$DXSetup$Logs\DirectX.log$\Logs$b:
                                                                                                                              • API String ID: 1979891910-370489754
                                                                                                                              • Opcode ID: 0cab36e9d61439833c1e7696a4bd4f752d2a08c36bf3a1ee4f9e8aa3b84f6a50
                                                                                                                              • Instruction ID: f5574d0ce9bcc06397f0cf1c12431b7fefd9a632762fab180fd851629d8c6c61
                                                                                                                              • Opcode Fuzzy Hash: 0cab36e9d61439833c1e7696a4bd4f752d2a08c36bf3a1ee4f9e8aa3b84f6a50
                                                                                                                              • Instruction Fuzzy Hash: 843190F2E442187ADF10F7A99C4AEEB77ACAB08B50F100979F505E6181FB74DB0A4764
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974B23F Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 192fileCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • FindFirstFileA.KERNELBASE(?,?,?,?,Logs\DirectX.log), ref: 6974B2AF
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6974B2BB
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$ErrorFileFindFirstLast_strrchr
                                                                                                                              • String ID: $$CSetup::CheckOnLogFile$FindFirstFile()$Logs\DirectX.log$Out of memory.$Unable to create path string, %s%s.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp$fopen()$fread() returned zero.
                                                                                                                              • API String ID: 1269276653-3498366787
                                                                                                                              • Opcode ID: bbdc836513c717aba27637902773d2b710a692ca2dc5920e0afdfa8a8a2b4744
                                                                                                                              • Instruction ID: 7f62e9b21fd9236a4caafd6c85904a762e9933d8b37d2c8e799e503ab8ba4d7f
                                                                                                                              • Opcode Fuzzy Hash: bbdc836513c717aba27637902773d2b710a692ca2dc5920e0afdfa8a8a2b4744
                                                                                                                              • Instruction Fuzzy Hash: BB515A79E8121876EB2096A88F89FCE336DDF15F18F5041A1F60CB5093EF74AF904A55
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A83C3F Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 77libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 00A83C6C
                                                                                                                              • LoadLibraryA.KERNEL32(advpack.dll), ref: 00A83CA8
                                                                                                                              • GetProcAddress.KERNEL32(00000000,IsNTAdmin), ref: 00A83CBC
                                                                                                                              • GetLastError.KERNEL32(Module: %s, Function: %s,advpack.dll,IsNTAdmin), ref: 00A83CE7
                                                                                                                              • FreeLibrary.KERNELBASE(00000000), ref: 00A83D08
                                                                                                                              • GetLastError.KERNEL32(Unable to load %s.,advpack.dll), ref: 00A83D17
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastLibrary$AddressFreeLoadProcVersion
                                                                                                                              • String ID: GetProcAddress()$IsAdmin$IsNTAdmin$LoadLibrary()$Module: %s, Function: %s$Unable to load %s.$advpack.dll$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 3600083760-2055996021
                                                                                                                              • Opcode ID: d359231f2307344d77dd988684baab5bdd5ee88fadc237691b156493fe229cd1
                                                                                                                              • Instruction ID: 287ad620d19b0940ff638cd3cdde136991ff86382dfb392006977355ef7137d8
                                                                                                                              • Opcode Fuzzy Hash: d359231f2307344d77dd988684baab5bdd5ee88fadc237691b156493fe229cd1
                                                                                                                              • Instruction Fuzzy Hash: A721B872E50254FBDB20BBB58C4AFAA76BCBF54B55F4408A4F10DA1182EB744E46CF21
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697569F2 Relevance: 24.5, APIs: 16, Instructions: 497COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 12996d19f9f49bf544c2de0463318148b12afa1af68f11edd31b9a00e0cf0c81
                                                                                                                              • Instruction ID: 9bde3add1a36e7927e98a8eaedda6b3df0741d9803dec032d05986e78bdde540
                                                                                                                              • Opcode Fuzzy Hash: 12996d19f9f49bf544c2de0463318148b12afa1af68f11edd31b9a00e0cf0c81
                                                                                                                              • Instruction Fuzzy Hash: 99124A31D046288FDFA0CF24CE45BAAB7B5FB05752F4095E5E81AA7180DB319EA1CF51
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8EE9B Relevance: 24.5, APIs: 16, Instructions: 497COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b2c3f9ff53cbbf9e7409c9dc6042b38972140172f7f369eb8355ab20e66dd7d9
                                                                                                                              • Instruction ID: 9db32b16c912061b1ffc291dd50e50c4bb2de2da12a523caf97e57738b79def5
                                                                                                                              • Opcode Fuzzy Hash: b2c3f9ff53cbbf9e7409c9dc6042b38972140172f7f369eb8355ab20e66dd7d9
                                                                                                                              • Instruction Fuzzy Hash: 93126B3190062ACFDB24EF68DC44BAAB7B4EF04312F5041E6E959E7181EB308E82DF51
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09DD9D Relevance: 24.5, APIs: 16, Instructions: 497COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 46531bc1c3dea272ac028788394eecae7699e5e7553b08fcce398054315b74bf
                                                                                                                              • Instruction ID: 77041fdad02e7ed4336d2e9df444c7f2a5896a047590c911cf1ac3d623425c42
                                                                                                                              • Opcode Fuzzy Hash: 46531bc1c3dea272ac028788394eecae7699e5e7553b08fcce398054315b74bf
                                                                                                                              • Instruction Fuzzy Hash: C5126D719046288FDB20CF24CC84BAA77F4BF09716F5065D5E869E7680DB319E81EF91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69746CEC Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 64fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindFirstFileA.KERNELBASE(?,?,?,00000104,?,\ntkrnlpa.exe,00000104), ref: 69746D8F
                                                                                                                              • FindClose.KERNELBASE(00000000), ref: 69746D9B
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Find__wstrtime$CloseFileFirst_strrchr
                                                                                                                              • String ID: IsFileAvailable$StringCchCopy()$Unable to create path string, %s%s.$\ntkrnlpa.exe$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 317478765-446419479
                                                                                                                              • Opcode ID: 016cb5a6bd1632bff1efa3a5b87857ca7a6d302305b3460c5719a817aff1b7d2
                                                                                                                              • Instruction ID: c3f25355c4ec588e7ceefd11ce08e7087ddfe9595ff3adf3948da17b04dfc39a
                                                                                                                              • Opcode Fuzzy Hash: 016cb5a6bd1632bff1efa3a5b87857ca7a6d302305b3460c5719a817aff1b7d2
                                                                                                                              • Instruction Fuzzy Hash: 3911E571980248BADF10EA658F48EEF73ACFB7AF14F400561B814E7042FE30EB548A61
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A844B1 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 64fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindFirstFileA.KERNELBASE(?,?), ref: 00A84554
                                                                                                                              • FindClose.KERNEL32(00000000), ref: 00A84560
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Find__wstrtime$CloseFileFirst_strrchr
                                                                                                                              • String ID: IsFileAvailable$StringCchCopy()$Unable to create path string, %s%s.$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 317478765-495664935
                                                                                                                              • Opcode ID: ce1c3fde33a25cec30427c14d72ed29a27667850225dc4fbbb3d140d5252ed82
                                                                                                                              • Instruction ID: 0d2bf4b421379cb161c6afe90a19bee67b7c4e699204464177e34f21fcc429fe
                                                                                                                              • Opcode Fuzzy Hash: ce1c3fde33a25cec30427c14d72ed29a27667850225dc4fbbb3d140d5252ed82
                                                                                                                              • Instruction Fuzzy Hash: C211E5B6E8020577DB24FBA58D0AEEF37BCAF59B14F110911F815F6080E9B09E468760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974E873 Relevance: 137.0, APIs: 8, Strings: 70, Instructions: 523registryCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 0 6974e873-6974e8d2 call 6974b23f call 69746210 * 2 call 6974ac14 9 6974e8d4-6974e8db call 697493df 0->9 10 6974e8ec-6974e908 RegOpenKeyExA 0->10 9->10 22 6974e8dd-6974e8e7 9->22 11 6974e97a-6974e986 10->11 12 6974e90a-6974e942 RegQueryValueExA 10->12 16 6974e98b-6974e991 call 69746391 11->16 14 6974e944-6974e951 call 69746210 12->14 15 6974e957-6974e965 RegCloseKey 12->15 14->15 19 6974e994-6974e9a6 call 69746210 15->19 20 6974e967-6974e978 15->20 16->19 29 6974e9ab-6974e9ca call 6974b5f6 call 69748c66 19->29 20->16 23 6974ea58-6974ea6b 22->23 27 6974ecf0-6974ecf6 23->27 28 6974ea71-6974ea77 23->28 32 6974ecfc-6974ed02 27->32 33 6974edbe-6974ee0e call 69746210 call 6974b5f6 27->33 30 6974eaa7-6974eaba call 697472fc 28->30 31 6974ea79-6974eaa2 call 69746b4f call 697485ae call 6974a3ce 28->31 54 6974e9d0 29->54 55 6974ea52 29->55 47 6974eac0-6974eac2 30->47 48 6974ec69-6974ec86 call 697491c4 30->48 31->30 32->33 37 6974ed08-6974ed27 RegOpenKeyExA 32->37 92 6974ee17-6974ee1c 33->92 93 6974ee10-6974ee12 call 697472fc 33->93 43 6974eda0-6974edac 37->43 44 6974ed29-6974ed3c RegDeleteValueA 37->44 49 6974edb1-6974edbb call 69746391 43->49 51 6974ed6c-6974ed7c call 69746210 44->51 52 6974ed3e-6974ed41 44->52 57 6974ebb1-6974ebbe call 6974b4e4 47->57 58 6974eac8-6974eacb 47->58 85 6974eccc-6974eceb call 6974b5f6 48->85 104 6974ec88-6974ec9f call 697491c4 48->104 49->33 63 6974ed7d-6974ed8b RegCloseKey 51->63 62 6974ed43-6974ed6a call 69746391 52->62 52->63 54->55 65 6974e9f5-6974e9fa 54->65 66 6974eb76-6974eb7b 54->66 67 6974e9d7-6974e9dc 54->67 68 6974ea30-6974ea35 54->68 69 6974eb13-6974eb1a call 6974aa25 54->69 70 6974eb7d-6974eb82 54->70 71 6974e9ff-6974ea04 54->71 72 6974ea3a-6974ea41 call 6974a978 54->72 73 6974eb84 54->73 74 6974ea26-6974ea2b 54->74 75 6974eb47-6974eb4e call 6974ab73 54->75 76 6974e9e1-6974e9e6 54->76 77 6974eb61-6974eb66 54->77 78 6974eb2d-6974eb34 call 6974aad4 54->78 79 6974eb6f-6974eb74 54->79 80 6974eb68-6974eb6d 54->80 81 6974ea09-6974ea10 call 69748484 54->81 82 6974e9eb-6974e9f0 54->82 55->23 57->85 116 6974ebc4-6974ebc7 57->116 84 6974ead1-6974eaec call 697491c4 58->84 58->85 62->63 63->33 87 6974ed8d-6974ed9e 63->87 97 6974eb89-6974eb96 call 69746210 65->97 66->97 67->97 68->97 137 6974eb26-6974eb2b 69->137 138 6974eb1c-6974eb21 69->138 70->97 71->97 132 6974ea47 72->132 133 6974eb0c-6974eb11 72->133 73->97 74->97 123 6974eb50-6974eb55 75->123 124 6974eb5a-6974eb5f 75->124 76->97 77->97 121 6974eb36-6974eb3b 78->121 122 6974eb40-6974eb45 78->122 79->97 80->97 130 6974ea12-6974ea17 81->130 131 6974ea1c-6974ea21 81->131 82->97 135 6974eaf2-6974eb07 call 69746210 84->135 136 6974eb9b-6974ebac 84->136 85->27 87->49 99 6974ee54-6974ee65 call 6974a365 92->99 100 6974ee1e-6974ee27 DestroyWindow 92->100 93->92 97->23 146 6974ee67-6974ee86 call 697485ae call 6974a5d2 99->146 147 6974eee2-6974eeea 99->147 113 6974ee51 100->113 114 6974ee29-6974ee4e GetLastError call 69746391 100->114 140 6974eca1-6974eca6 call 69746210 104->140 141 6974ecae-6974ecba 104->141 113->99 114->113 127 6974ebdf-6974ebe5 116->127 128 6974ebc9-6974ebda call 69746210 116->128 139 6974ea4c-6974ea51 call 69746210 121->139 122->97 123->139 124->97 148 6974ebe7-6974ebef call 6974cec8 127->148 149 6974ec02-6974ec14 call 69749ca1 127->149 128->85 130->97 131->97 132->139 133->97 135->85 142 6974ecbf-6974ecc9 call 69746391 136->142 137->97 138->139 139->55 164 6974ecab-6974ecac 140->164 141->142 142->85 177 6974eeaf-6974eecd call 69746391 146->177 178 6974ee88-6974eea1 call 69746210 146->178 155 6974eeec-6974ef13 call 69746be5 147->155 156 6974eecf-6974eee1 call 6974fc82 147->156 167 6974ebf4-6974ebfc 148->167 149->85 169 6974ec1a-6974ec37 call 697491c4 149->169 173 6974eff1 155->173 174 6974ef19 155->174 156->147 164->85 167->85 167->149 169->85 201 6974ec3d-6974ec47 call 697491c4 169->201 176 6974eff6 173->176 174->173 180 6974ef94 174->180 181 6974ef34-6974ef39 174->181 182 6974efd5-6974efda 174->182 183 6974efb5-6974efba 174->183 184 6974ef77-6974ef8b call 6974d3b0 174->184 185 6974ef70-6974ef75 174->185 186 6974ef52-6974ef57 174->186 187 6974efdc-6974efe1 174->187 188 6974efbc-6974efd3 call 69746b8b 174->188 189 6974ef5c-6974ef61 174->189 190 6974ef3e-6974ef43 174->190 191 6974ef66-6974ef6b 174->191 192 6974ef20-6974ef25 174->192 193 6974efe3-6974efe8 174->193 194 6974efae-6974efb3 174->194 195 6974ef48-6974ef4d 174->195 196 6974efea-6974efef 174->196 197 6974ef2a-6974ef2f 174->197 202 6974effc-6974effe call 69746b8b 176->202 177->147 178->147 212 6974eea3-6974eead 178->212 204 6974ef9a-6974efac call 69746b4f 180->204 181->176 182->176 183->176 184->204 215 6974ef8d-6974ef92 184->215 185->176 186->176 187->176 188->176 189->176 190->176 191->176 192->176 193->176 194->176 195->176 196->176 197->176 213 6974ec4c-6974ec54 201->213 214 6974f003-6974f00a call 69746210 202->214 204->214 212->147 213->140 218 6974ec56-6974ec67 213->218 219 6974f00f-6974f02b call 6974e409 call 6974fc2e 214->219 215->202 218->142
                                                                                                                              APIs
                                                                                                                              • RegOpenKeyExA.KERNEL32(80000002,Software\Microsoft\DirectX,00000000,00000001,?), ref: 6974E900
                                                                                                                              • RegQueryValueExA.KERNEL32 ref: 6974E93A
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6974E95D
                                                                                                                                • Part of subcall function 697493DF: GetVersionExA.KERNEL32(?), ref: 6974940C
                                                                                                                                • Part of subcall function 697493DF: LoadLibraryA.KERNEL32(advpack.dll), ref: 69749448
                                                                                                                                • Part of subcall function 697493DF: GetProcAddress.KERNEL32(00000000,IsNTAdmin), ref: 6974945C
                                                                                                                                • Part of subcall function 697493DF: FreeLibrary.KERNEL32(00000000), ref: 697494A8
                                                                                                                              • RegOpenKeyExA.KERNEL32(80000002,Software\Microsoft\DirectX,00000000,00020006,?), ref: 6974ED1F
                                                                                                                              • RegDeleteValueA.KERNEL32(?,ManagedDirectXVersion), ref: 6974ED34
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6974ED83
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                                • Part of subcall function 69746391: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 69746521
                                                                                                                                • Part of subcall function 69746391: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00066BDB), ref: 69746546
                                                                                                                              • DestroyWindow.USER32 ref: 6974EE1F
                                                                                                                              • GetLastError.KERNEL32(Not fatal...), ref: 6974EE2E
                                                                                                                                • Part of subcall function 697472FC: LoadStringA.USER32 ref: 6974736D
                                                                                                                                • Part of subcall function 697472FC: GetLastError.KERNEL32(00000000), ref: 69747378
                                                                                                                                • Part of subcall function 69746391: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00066BDB,00000000), ref: 6974654E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$CloseFreeLibraryLoadOpenValue__wstrtime$AddressDeleteDestroyFormatLocalMessageProcQueryStringVersionWindow_strrchr
                                                                                                                              • String ID: %s %s$%s will be removed at reboot.$.NETframework is not installed.$04:38:03$=== SetupForDirectX() start ===$A cabinet file necessary for installation cannot be trusted.$CSetup::SetupForDirectX$Can't find a directory$Can't find inf file$Could not find $Current logon user doesn't have the Administrator privilege$DXRemoveFileAtReboot() failed. (Not fatal...)$DXSetup$DXSetupCommand = %d.$DXTempFolder$DestroyWindow()$Downloading failed, need to run setup again.$Feb2005_MDX_x86.MSI$File not copied$Found Alpha$InstallPlugIn() failed.$Installation ended with value %d = $Installation succeeded$Installation succeeded need restart$Installing on NEC OPK$Installing on NEC Win2K$Installing on NEC Win95$Installing on NEC Win98$Installing on NEC WinXP$Installing on Win2K$Installing on Win2K Server$Installing on Win95$Installing on Win98$Installing on WinNT 4.0$Installing on WinXP$Installing on WinXP (64bit)$Installing on WinXP SP (64bit)$Installing on WinXP SP1$Installing on WinXP SP2 (64bit)$Installing on WinXP SP2/SP3$Installing on Windows ME$Installing on Windows ME NEC$Installing on Windows Server 2003$Installing on Windows Server 2003 (64bit)$Installing on Windows Server 2003 SP1 (64bit)$Installing on Windows Server 2003 SP1/SP2$Internal or unsupported error$ManagedDirectXVersion$Mar 30 2011$Newer version already installed$Not fatal...$One or more DirectX component files are being used, need to exit all applications.$Out of disk space$Processor type is unsupported by DirectX 8$RegCloseKey()$RegDeleteValue()$RegOpenKeyEx()$SetupForDirectX(): %s is removed from DirectX key.$SetupForDirectX(): query dxsetup command: result = %d.$SetupForDirectX: InstallPlugIn() Succeeded.$SetupfForDirectX(): IA64 is not supported.$Software\Microsoft\DirectX$Source file not found$Unable to remove %s from DirectX key$Unknown OS$Unknown error$Unsupported window version$Version$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp$start finalizing: phase: %d - %d, total: %d - %d
                                                                                                                              • API String ID: 3617327385-668854391
                                                                                                                              • Opcode ID: c8277d9ac1e5cce2dd668e15d5a2944eaec53407391ca2b4845f9022a7209a55
                                                                                                                              • Instruction ID: 05af97f35e1565c1ff67b4e6ab4240bdc7c67cd37f78481977248e198190b8ac
                                                                                                                              • Opcode Fuzzy Hash: c8277d9ac1e5cce2dd668e15d5a2944eaec53407391ca2b4845f9022a7209a55
                                                                                                                              • Instruction Fuzzy Hash: 4C021874A8425DBADB20DE648F85FBE72E8BF15F64F40486AF145A3143EF305B40AB12
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C094B10 Relevance: 86.0, APIs: 24, Strings: 25, Instructions: 235libraryloaderCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 224 6c094b10-6c094b30 225 6c094ca9-6c094cb5 224->225 226 6c094b36-6c094b4b GetCurrentDirectoryW 224->226 227 6c094ced-6c094cf3 225->227 228 6c094cb7-6c094ccb GetProcAddress 225->228 229 6c094b78-6c094b8e GetModuleFileNameW 226->229 230 6c094b4d-6c094b5f GetLastError 226->230 232 6c094d2b-6c094d31 227->232 233 6c094cf5-6c094d09 GetProcAddress 227->233 228->227 231 6c094ccd-6c094ce3 GetLastError 228->231 235 6c094ba9-6c094bbb call 6c096e8f 229->235 236 6c094b90-6c094ba7 GetLastError 229->236 234 6c094b64-6c094b6e call 6c0964d5 230->234 231->227 240 6c094d71-6c094d77 232->240 241 6c094d33-6c094d47 GetProcAddress 232->241 233->232 238 6c094d0b-6c094d21 GetLastError 233->238 253 6c094b71-6c094b73 234->253 248 6c094bc1-6c094bd7 SetCurrentDirectoryW 235->248 249 6c094c93-6c094c9f 235->249 236->234 238->232 243 6c094d79-6c094d8d GetProcAddress 240->243 244 6c094daf-6c094db5 240->244 246 6c094d69 241->246 247 6c094d49-6c094d5f GetLastError 241->247 243->244 250 6c094d8f-6c094da5 GetLastError 243->250 251 6c094ded-6c094df3 244->251 252 6c094db7-6c094dcb GetProcAddress 244->252 246->240 247->246 254 6c094bd9-6c094bf0 GetLastError 248->254 255 6c094bf5-6c094c0f call 6c0949bf 248->255 249->225 250->244 257 6c094e2b-6c094e31 251->257 258 6c094df5-6c094e09 GetProcAddress 251->258 252->251 256 6c094dcd-6c094de3 GetLastError 252->256 259 6c094e6c-6c094e7a call 6c096df2 253->259 254->234 268 6c094c3a-6c094c51 LoadLibraryW SetCurrentDirectoryW 255->268 269 6c094c11-6c094c35 call 6c0964d5 255->269 256->251 263 6c094e69-6c094e6b 257->263 264 6c094e33-6c094e47 GetProcAddress 257->264 258->257 262 6c094e0b-6c094e21 GetLastError 258->262 262->257 263->259 264->263 267 6c094e49-6c094e5f GetLastError 264->267 267->263 271 6c094c6f-6c094c75 268->271 272 6c094c53-6c094c65 GetLastError 268->272 269->253 271->225 274 6c094c77-6c094c89 GetLastError 271->274 272->271 274->249
                                                                                                                              APIs
                                                                                                                              • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 6C094B43
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C094B4E
                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00000104), ref: 6C094B86
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C094B91
                                                                                                                              • SetCurrentDirectoryW.KERNELBASE(?), ref: 6C094BD3
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C094BDA
                                                                                                                              • LoadLibraryW.KERNEL32(?,?,00000104,\DSETUP32.DLL), ref: 6C094C3B
                                                                                                                              • SetCurrentDirectoryW.KERNELBASE(?), ref: 6C094C4D
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C094C54
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C094C78
                                                                                                                              • GetProcAddress.KERNEL32(iDirectXSetup), ref: 6C094CC2
                                                                                                                              • GetLastError.KERNEL32(Module: dsetup32.dll, Function: iDirectXSetup), ref: 6C094CD2
                                                                                                                              • GetProcAddress.KERNEL32(DirectXSetupCallback), ref: 6C094D00
                                                                                                                              • GetLastError.KERNEL32(Module: dsetup32.dll, Function: DirectXSetupCallback), ref: 6C094D10
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$CurrentDirectory$AddressProc$FileLibraryLoadModuleName
                                                                                                                              • String ID: DirectXLoadString$DirectXSetupCallback$DirectXSetupSetCallback$DirectXSetupShowEULA$GetCurrentDirectory()$GetModuleFileName()$GetProcAddress()$LoadDSetup32$LoadLibrary()$Module: dsetup32.dll, Function: iDirectXSetupGetEULAA$Module: dsetup32.dll, Function: iDirectXSetupGetEULAW$Module: dsetup32.dll, Function: DirectXLoadString$Module: dsetup32.dll, Function: DirectXSetupCallback$Module: dsetup32.dll, Function: DirectXSetupSetCallback$Module: dsetup32.dll, Function: DirectXSetupShowEULA$Module: dsetup32.dll, Function: iDirectXSetup$SetCurrentDirectory()$Unable to create path string, %s%s.$Unable to find backslash.$\DSETUP32.DLL$\DSETUP32.DLL$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c$iDirectXSetup$iDirectXSetupGetEULAA$iDirectXSetupGetEULAW
                                                                                                                              • API String ID: 3381434992-2627784856
                                                                                                                              • Opcode ID: ae7711ee58c50da49f1bcfa149ebf0b299ef908b25cddb74b0d7130c4fc22525
                                                                                                                              • Instruction ID: cf46d1e3f930a1024f0e8ef948167c3dfc9c5c89483e7ef2945c0fdbdb59ddcb
                                                                                                                              • Opcode Fuzzy Hash: ae7711ee58c50da49f1bcfa149ebf0b299ef908b25cddb74b0d7130c4fc22525
                                                                                                                              • Instruction Fuzzy Hash: 1A719FB9745A04BEDF006FE58C44F5B3AFCBB06309B007D66F22AE1C52EA70C444BA91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974CEC8 Relevance: 66.9, APIs: 16, Strings: 22, Instructions: 381COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 392 6974cec8-6974cf07 call 69746b4f call 69747269 397 6974cf40-6974cf46 392->397 398 6974cf09-6974cf18 call 6974ac39 392->398 400 6974cf5d-6974cf6d GetModuleHandleA call 69749a79 397->400 401 6974cf48-6974cf4b 397->401 398->397 405 6974cf1a-6974cf3b call 69746391 398->405 407 6974cf72-6974cf74 400->407 401->400 403 6974cf4d-6974cf5b call 69746b4f 401->403 411 6974cf7a-6974cf89 call 697485ae call 6974a078 403->411 416 6974d39b-6974d3a8 call 6974fc2e 405->416 410 6974d379-6974d37c 407->410 407->411 412 6974d39a 410->412 421 6974cfa1-6974cfa9 call 6974a303 411->421 422 6974cf8b-6974cf9c 411->422 412->416 427 6974cfc5 421->427 428 6974cfab-6974cfb4 421->428 423 6974d2be-6974d2cb call 69746391 422->423 423->410 432 6974cfc7-6974cfcc 427->432 430 6974cfb6-6974cfb9 428->430 431 6974cfc0-6974cfc3 428->431 430->431 433 6974cfbb-6974cfbe 430->433 431->432 434 6974cfce-6974cfda call 69746b4f 432->434 435 6974cfdf-6974cff1 call 6974ac14 432->435 433->427 433->431 440 6974d395 call 6974a77b 434->440 441 6974cff3-6974d006 call 69746c43 435->441 442 6974d03a-6974d044 GetTempPathA 435->442 440->412 451 6974d00c-6974d035 call 69746391 441->451 452 6974d1cf-6974d1ed call 697485ae call 697501ea 441->452 445 6974d0b5-6974d0bc call 69747269 442->445 446 6974d046-6974d06e GetLastError call 69746210 ExpandEnvironmentStringsA 442->446 455 6974d0be-6974d0c5 call 697481fa 445->455 456 6974d0cb-6974d0d2 445->456 446->452 458 6974d074-6974d089 ExpandEnvironmentStringsA 446->458 451->410 475 6974d260-6974d26f call 6974a078 452->475 476 6974d1ef-6974d1f8 call 69746cec 452->476 455->452 455->456 456->452 462 6974d0d8-6974d0e8 GetCurrentDirectoryA 456->462 458->452 463 6974d08f-6974d0b0 call 69746210 call 697475af 458->463 466 6974d1bc-6974d1cd GetLastError call 69746210 462->466 467 6974d0ee-6974d101 call 6974a078 462->467 463->452 478 6974d1ce 466->478 482 6974d103-6974d114 467->482 483 6974d119-6974d12e call 697466cc 467->483 488 6974d284-6974d2a6 GetTempFileNameA 475->488 489 6974d271-6974d282 475->489 486 6974d1fd-6974d1ff 476->486 478->452 482->423 483->452 491 6974d134-6974d13b 483->491 486->475 490 6974d201-6974d211 CreateDirectoryA 486->490 492 6974d2d0-6974d2e2 call 6974a365 488->492 493 6974d2a8-6974d2b9 GetLastError 488->493 489->423 494 6974d213-6974d21e GetLastError 490->494 495 6974d24d-6974d25f call 69746210 490->495 496 6974d146-6974d15c GetDriveTypeA 491->496 497 6974d13d-6974d144 491->497 507 6974d2e4-6974d2f7 call 69746391 492->507 508 6974d2fa-6974d30a CreateDirectoryA 492->508 493->423 494->475 499 6974d220-6974d24b call 69746210 call 697475af 494->499 495->475 504 6974d1b0-6974d1ba call 69746210 496->504 505 6974d15e-6974d161 496->505 497->496 502 6974d16d-6974d18d call 69746c43 497->502 499->475 502->452 525 6974d18f-6974d1ab 502->525 504->478 505->504 509 6974d163-6974d166 505->509 507->508 515 6974d33c-6974d344 508->515 516 6974d30c-6974d33a GetLastError call 69746391 508->516 509->502 517 6974d168-6974d16b 509->517 523 6974d354-6974d359 515->523 524 6974d346-6974d353 call 697501ea 515->524 516->412 517->452 517->502 529 6974d37e-6974d38f call 69746b8b 523->529 530 6974d35b-6974d370 523->530 524->523 528 6974d371-6974d376 call 69746391 525->528 528->410 529->440 530->528
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 6974AC39: RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion,00000000,00000001,?), ref: 6974AC6E
                                                                                                                              • GetModuleHandleA.KERNEL32(00000000,?,?,?,00000104,?,?,?), ref: 6974CF66
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$HandleModuleOpen_strrchr
                                                                                                                              • String ID: %temp%$%tmp%$BuildPaths(): GetCurrentDirectory() failed, error = %d, continue...$BuildPaths(): GetTempPath(): Unable to get temp path due to code:%d, try to scan environment value.$BuildPaths(): Unable to get temp path from environment value, use system drive.$BuildPaths(): temp directory %s is created.$BuildPaths(): unable to create temp directory: %s, error = %d, use system drive.$BuildPaths(): unable to detect drive type, continue...$CSetup::BuildPaths$CreateDirectory()$DeleteTempDir() failed. (Not fatal...)$DirectX$GetTempFileName()$New temp path is too long, %s.$Unable to create path string, %s%s.$Unable to create path string, %stemp\.$Unable to find Program Files directory.$\$\$appendSlash() failed.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp$temp\
                                                                                                                              • API String ID: 3670481093-1835560824
                                                                                                                              • Opcode ID: c700686175171a43e6a94b7a2771ceaa5c3a112a27451b8b3e492eef61c26bf6
                                                                                                                              • Instruction ID: c160d6f3b58a1d2b049d8ea9f02ff84f26a6844748da532ec9e1227f5a9dcedc
                                                                                                                              • Opcode Fuzzy Hash: c700686175171a43e6a94b7a2771ceaa5c3a112a27451b8b3e492eef61c26bf6
                                                                                                                              • Instruction Fuzzy Hash: 8AC1ECB6A442047AEB11E6718F49FEF72ACAF06F44F404577F959E1083EB30EB448A65
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974A77B Relevance: 36.9, APIs: 9, Strings: 12, Instructions: 168COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • _strnlen.LIBCMT ref: 6974A7A9
                                                                                                                              • _strnlen.LIBCMT ref: 6974A7BD
                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,00000104,system,?,00000104,?,CSetup::BuildPaths,e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp,00000104), ref: 6974A82B
                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,00000104,inf,?,00000104,?), ref: 6974A85E
                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,00000104,help,?,00000104,?), ref: 6974A891
                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,00000104,directx,?,00000104,?), ref: 6974A8C4
                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,00000104,drivers,?,00000104,?), ref: 6974A8F3
                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,00000104,sysbckup,?,00000104,?), ref: 6974A922
                                                                                                                              • GetLastError.KERNEL32 ref: 6974A928
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateDirectory$_strnlen$ErrorLast
                                                                                                                              • String ID: CSetup::BuildPaths$CreateDirectory()$MakeTempSubDirectorys$Temp directory is too long, %s%s.$directx$drivers$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp$help$inf$sysbckup$system
                                                                                                                              • API String ID: 2702963399-732964606
                                                                                                                              • Opcode ID: de8229a5b94c7fdb15b0db8cb7c864c69bec57d7c39c44c6de8c7a22c959027d
                                                                                                                              • Instruction ID: 55ee881fbcf4f4a0e2962eef6d4982734282c1f31fa9e30e47f417101de69839
                                                                                                                              • Opcode Fuzzy Hash: de8229a5b94c7fdb15b0db8cb7c864c69bec57d7c39c44c6de8c7a22c959027d
                                                                                                                              • Instruction Fuzzy Hash: 8B5181B69442187ADB10E6A48E84FDE73ACAF55F54F1144B5B584E3082EE74ABC4CE70
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974D948 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 137timefileCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 6974D9AA
                                                                                                                              • GetFileTime.KERNEL32(?,?,?,?,?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 6974D9DA
                                                                                                                              • LocalFileTimeToFileTime.KERNEL32(?,?,?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 6974D9FD
                                                                                                                              • SetFileTime.KERNEL32(?,?,?,?,?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 6974DA16
                                                                                                                              • GetLastError.KERNEL32(00000000,?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 6974DA21
                                                                                                                              • GetLastError.KERNEL32(00000000,?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 6974DA37
                                                                                                                              • GetLastError.KERNEL32(00000000,?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 6974DA4D
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 6974DA6E
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6974DA79
                                                                                                                              • GetLastError.KERNEL32(Unable to open %s.,?,?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 6974DA9D
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLast$Time$CloseCreateHandleLocal
                                                                                                                              • String ID: CabCallback$CloseHandle()$CreateFile()$Extracted file %s from cab$GetFileTime()$LocalFileTimeToFileTime()$SPFILENOTIFY_FILEEXTRACTED: error = %d.$SetFileTime()$Unable to open %s.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 2084486756-1895325444
                                                                                                                              • Opcode ID: 076e81efeb319c0b4912dc8e7fa83f0cda754e14cb085558c693b4ea66e279dc
                                                                                                                              • Instruction ID: 5019a7938c1e9395d8500c36c1651464d3ebf603c62eaed260b238565146c2c6
                                                                                                                              • Opcode Fuzzy Hash: 076e81efeb319c0b4912dc8e7fa83f0cda754e14cb085558c693b4ea66e279dc
                                                                                                                              • Instruction Fuzzy Hash: EC41D071744258BBEB119B608E4AFAA7BACEF06F50F404567F914E6193DB30AF00DE64
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697495FD Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 279libraryloaderCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 623 697495fd-6974963a LoadLibraryA 624 69749640-69749657 GetProcAddress 623->624 625 6974997a-69749985 GetLastError 623->625 626 6974965d-69749672 624->626 627 6974984e-6974985d GetProcAddress 624->627 628 69749987-6974998a 625->628 629 697499be-697499c8 call 69746210 625->629 626->627 640 69749678-69749693 626->640 631 69749960 627->631 632 69749863-6974987a 627->632 628->629 633 6974998c-6974998f 628->633 639 697499c9-697499dc call 6974fc2e 629->639 637 69749965-6974996a call 69746210 631->637 646 69749880-697498dd call 69750721 * 3 632->646 647 69749959-6974995e 632->647 633->629 634 69749991-69749996 633->634 634->629 638 69749998-697499bc GetLastError call 69746391 634->638 652 6974996b-69749978 FreeLibrary 637->652 638->639 654 6974983d-69749849 640->654 655 69749699-697496b7 640->655 666 697498df-697498e5 646->666 667 69749939-69749957 call 69746391 646->667 647->637 652->639 654->652 661 69749831-69749839 655->661 662 697496bd 655->662 661->654 664 697496c2-697496ca 662->664 664->661 665 697496d0-697496f0 664->665 673 697496f6-69749752 call 69750721 * 3 665->673 674 69749801-6974982b 665->674 666->667 669 697498e7-697498e9 666->669 667->652 669->667 672 697498eb-697498f1 669->672 675 697498f3-697498f6 672->675 676 697498f8 672->676 673->674 692 69749758-6974975e 673->692 674->661 674->664 675->676 678 697498fb-69749937 call 697506fa * 3 call 69746210 675->678 676->678 678->652 692->674 694 69749764-69749766 692->694 694->674 696 6974976c-69749772 694->696 697 69749774-69749777 696->697 698 69749779 696->698 697->698 699 6974977c-697497b8 call 697506fa * 3 call 69746210 697->699 698->699 707 697497bd-697497ca 699->707 708 697497d1-697497d3 707->708 709 697497cc-697497cf 707->709 711 697497d5-697497d7 708->711 712 697497e2-697497eb 708->712 709->708 710 697497ff 709->710 710->674 713 697497dd-697497e0 711->713 712->713 714 697497ed-697497f0 712->714 715 697497f2 713->715 714->715 716 697497f5 714->716 715->716 716->710
                                                                                                                              APIs
                                                                                                                              • LoadLibraryA.KERNEL32(mscoree.dll), ref: 6974962C
                                                                                                                              • GetProcAddress.KERNEL32(00000000,CLRCreateInstance), ref: 6974964D
                                                                                                                              • GetProcAddress.KERNEL32(?,GetCORVersion), ref: 69749859
                                                                                                                              • FreeLibrary.KERNELBASE(?), ref: 69749971
                                                                                                                              • GetLastError.KERNEL32 ref: 69749980
                                                                                                                              • GetLastError.KERNEL32(Unable to load mscoree.dll.), ref: 6974999D
                                                                                                                              Strings
                                                                                                                              • GetCORVersion not found in mscoree.dll, function deprecated for .NET Framework 4.0., xrefs: 69749960
                                                                                                                              • Unable to get CLR build number., xrefs: 69749939
                                                                                                                              • GetCORVersion, xrefs: 6974984E
                                                                                                                              • GetDotNETFrameworkVersion, xrefs: 69749940, 697499A5
                                                                                                                              • Unable to load mscoree.dll., xrefs: 69749998
                                                                                                                              • CLR version number = %d.%d.%d, xrefs: 69749920
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h, xrefs: 6974994A, 697499AF
                                                                                                                              • mscoree.dll is not available., xrefs: 697499BE
                                                                                                                              • LoadLibrary(), xrefs: 697499A0
                                                                                                                              • mscoree.dll, xrefs: 69749619
                                                                                                                              • CLRCreateInstance, xrefs: 69749647
                                                                                                                              • CLR version number = %d.%d.%d, xrefs: 697497B3
                                                                                                                              • GetCORVersion() failed, function deprecated for .NET Framework 4.0., xrefs: 69749959
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressErrorLastLibraryProc$FreeLoad
                                                                                                                              • String ID: CLR version number = %d.%d.%d$CLR version number = %d.%d.%d$CLRCreateInstance$GetCORVersion$GetCORVersion not found in mscoree.dll, function deprecated for .NET Framework 4.0.$GetCORVersion() failed, function deprecated for .NET Framework 4.0.$GetDotNETFrameworkVersion$LoadLibrary()$Unable to get CLR build number.$Unable to load mscoree.dll.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h$mscoree.dll$mscoree.dll is not available.
                                                                                                                              • API String ID: 1490555712-1049337429
                                                                                                                              • Opcode ID: 8c507a04bf5edd4aca846f4337cc9a4a4ab85fbf57f94b32cb9326dcf8d27200
                                                                                                                              • Instruction ID: ef97078072f2e35c99448043f07b08e4eedfea9c9d18eaecf158dfe2201a7d34
                                                                                                                              • Opcode Fuzzy Hash: 8c507a04bf5edd4aca846f4337cc9a4a4ab85fbf57f94b32cb9326dcf8d27200
                                                                                                                              • Instruction Fuzzy Hash: 9AA142B59002199BDB60DF55CE84E9DB7B8FF94B04F1044AEE60AE7202DB35DA90CF19
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974609F Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 114COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • GetWindowsDirectoryA.KERNEL32(?,00000104,?,00000258), ref: 697460D5
                                                                                                                              • OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.,?,00000258), ref: 697460E4
                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000), ref: 69746124
                                                                                                                              • GetLastError.KERNEL32 ref: 6974612E
                                                                                                                              • __wstrtime.LIBCMT ref: 69746187
                                                                                                                              • __wstrtime.LIBCMT ref: 69746190
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Directory__wstrtime$CreateDebugErrorLastOutputStringWindows
                                                                                                                              • String ID: %s %s: %s: %s$%s %s: %s: (null)$%s%s$%s%s%s$,fti$C:\Windows\Logs\DirectX.log$DXSETUP_DPF(): GetWindowsDirectory() failed.$DXSETUP_DPF(): Unable to open log file.$DXSETUP_DPF(): failed to create log directory.$DXSETUP_DPF(): path name too long.$Logs\DirectX.log$\Logs$dsetup32
                                                                                                                              • API String ID: 1979891910-478278169
                                                                                                                              • Opcode ID: c6e910ac13fad68ef142b42e8ff6cb6404b30d20c1cc7236f7342b2168c356de
                                                                                                                              • Instruction ID: dccb32c4f569f806a0528e7e68e16ee948cb58cf671d54508b8fc52133411994
                                                                                                                              • Opcode Fuzzy Hash: c6e910ac13fad68ef142b42e8ff6cb6404b30d20c1cc7236f7342b2168c356de
                                                                                                                              • Instruction Fuzzy Hash: 323176B6E44218BBD710FBA0CF49EEF77AC9B25F44F8084A6E614E2403EB34D7144A65
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C096212 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 114COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • GetWindowsDirectoryA.KERNEL32(?,00000104,?,00000258), ref: 6C096248
                                                                                                                              • OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.,?,00000258), ref: 6C096257
                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000), ref: 6C096297
                                                                                                                              • GetLastError.KERNEL32 ref: 6C0962A1
                                                                                                                              • __wstrtime.LIBCMT ref: 6C0962FA
                                                                                                                              • __wstrtime.LIBCMT ref: 6C096303
                                                                                                                                • Part of subcall function 6C094A54: _vswprintf_s.LIBCMT ref: 6C094A87
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Directory__wstrtime$CreateDebugErrorLastOutputStringWindows_vswprintf_s
                                                                                                                              • String ID: %s %s: %s: %s$%s %s: %s: (null)$%s%s$%s%s%s$C:\Windows\Logs\DirectX.log$DSETUP$DXSETUP_DPF(): GetWindowsDirectory() failed.$DXSETUP_DPF(): Unable to open log file.$DXSETUP_DPF(): failed to create log directory.$DXSETUP_DPF(): path name too long.$Logs\DirectX.log$\Logs$pgl
                                                                                                                              • API String ID: 2971342511-1831039183
                                                                                                                              • Opcode ID: 29dd3a7b2ae247d180770f6d81e82a7fe9247426337bc9a22260fdf5029dd25e
                                                                                                                              • Instruction ID: 64e995fe1a04c27df558a45ed6747eed3ee052624097f4f8a8dc2f716e1b258a
                                                                                                                              • Opcode Fuzzy Hash: 29dd3a7b2ae247d180770f6d81e82a7fe9247426337bc9a22260fdf5029dd25e
                                                                                                                              • Instruction Fuzzy Hash: B331C3B2908518BADB10DBA59C48FDF73FCAB45304F402466F719E3900EB34E608B6A6
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09375D Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 101synchronizationCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              • OutputDebugStringA.KERNELBASE(DLL_PROCESS_ATTACH), ref: 6C09377E
                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,DSETUP DLL Mutex), ref: 6C09378B
                                                                                                                              • GetLastError.KERNEL32(?,?,DSETUP DLL Mutex), ref: 6C0937A3
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C0937D2
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 6C0937FA
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C093809
                                                                                                                              • OutputDebugStringA.KERNELBASE(DLL_PROCESS_DETACH), ref: 6C09381F
                                                                                                                              • CloseHandle.KERNEL32 ref: 6C093839
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C093855
                                                                                                                              • FreeLibrary.KERNEL32(69740000), ref: 6C093876
                                                                                                                              • GetLastError.KERNEL32 ref: 6C093880
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$CloseDebugHandleOutputString$CreateFreeLibraryMutex
                                                                                                                              • String ID: CloseHandle()$CreateMutex()$DLL_PROCESS_ATTACH$DLL_PROCESS_DETACH$DSETUP DLL Mutex$DllMain$FreeLibrary()$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 619473299-1708209621
                                                                                                                              • Opcode ID: 414bf7d459bec7db9224f7e134d69349c808fe4138c56ceed0618760b21a524e
                                                                                                                              • Instruction ID: 21f0ae9022337bcb4a1e16c385b92d31eccea8f8438daab40aae40078d37ca34
                                                                                                                              • Opcode Fuzzy Hash: 414bf7d459bec7db9224f7e134d69349c808fe4138c56ceed0618760b21a524e
                                                                                                                              • Instruction Fuzzy Hash: 9A318478744B10BBDB006EA69C48F6F36FCBB4BB54B046151FA0DD3941DF20D411AAEA
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69748EE0 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 231COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 919 69748ee0-69748f11 920 69748f13-69748f1c call 6974cec8 919->920 921 69748f2d-69748f48 call 69746cec 919->921 920->921 926 69748f1e-69748f28 SetLastError 920->926 927 69748f4e-69748f57 call 69746cec 921->927 928 6974913b-69749156 call 69746210 call 6974fc92 921->928 929 697491af-697491bc call 6974fc2e 926->929 936 69748f5d-69748f71 call 69746cec 927->936 937 697490c8-697490cf call 69746210 927->937 944 69749164 928->944 945 69749158 928->945 947 69748f90-69748f97 936->947 948 69748f73-69748f7c call 69746cec 936->948 943 697490d4-697490e3 call 6974fc92 937->943 943->944 962 697490e5-697490e6 943->962 946 69749166-6974916a 944->946 950 69749159-6974915b call 69748d2e 945->950 953 69749174-69749194 call 69746391 946->953 954 6974916c-6974916e 946->954 952 69748f9b-69748fab call 69746c43 947->952 966 69748f7e-69748f8b call 69746210 948->966 967 69748f99-69748f9a 948->967 957 69749160-69749162 950->957 969 69748fad-69748fb3 952->969 970 69748fdf-69748ff3 call 6974e432 952->970 971 697491a4 953->971 972 69749196-6974919d call 697485e5 953->972 954->953 959 69749170-69749172 954->959 957->946 964 697491ae 959->964 962->950 964->929 973 697491a6-697491ac SetLastError 966->973 967->952 975 69748fb5 969->975 976 69748fbb-69748fda call 69746391 969->976 984 69748ff5-69748ffa 970->984 985 69748fff-69749020 call 69746210 call 6974fc92 970->985 971->973 983 6974919e-697491a3 call 6974fc82 972->983 973->964 975->976 976->973 983->971 984->973 992 69749022-69749024 call 6974d6cd 985->992 993 6974902d 985->993 996 69749029-6974902b 992->996 995 6974902f-69749033 993->995 997 6974910f-6974912f call 69746391 995->997 998 69749039-6974903b 995->998 996->995 997->971 1005 69749131-69749139 call 697485e5 997->1005 998->997 1000 69749041-69749068 SetupIterateCabinetA 998->1000 1002 697490af-697490bf call 697485e5 call 6974fc82 call 69746cec 1000->1002 1003 6974906a-697490aa GetLastError call 69746391 call 697485e5 call 6974fc82 1000->1003 1018 697490c4-697490c6 1002->1018 1003->973 1005->983 1018->937 1019 697490e8-6974910a call 69746391 1018->1019 1019->973
                                                                                                                              APIs
                                                                                                                              • SetLastError.KERNEL32(00000003,00000000), ref: 69748F20
                                                                                                                              • SetLastError.KERNEL32(00000001,?,?,?,?,?,?,?), ref: 697491A6
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast
                                                                                                                              • String ID: CSetup::GetCDXUpdate$GetCDXUpdate(): Extracting %s from %s.$GetCDXUpdate(): Loading %s in %s.$GetCDXUpdate(): no DXUpdate.$SetupIterateCabinet()$Unable to create path string, %s%s.$Unable to find dxupdate.dll.$Unable to initialize CDXUpdate.$Unable to initialize CSetupAPI.$Unable to iterate through %s. The file may be damaged.$dxupdate.cab$dxupdate.dll$e:\bt\382730\setup\deliverables\dsetup\dsetup32\dxupdate.cpp
                                                                                                                              • API String ID: 1452528299-2091673329
                                                                                                                              • Opcode ID: eabe98f5373da6baa8153f1e2aff589a5daf1ee2d44b8951c7ae6f3ea52ffaf7
                                                                                                                              • Instruction ID: aa86edaa02ff2d139281723e3c34f635a161c9b1841164f47c63bc7eb3c6208b
                                                                                                                              • Opcode Fuzzy Hash: eabe98f5373da6baa8153f1e2aff589a5daf1ee2d44b8951c7ae6f3ea52ffaf7
                                                                                                                              • Instruction Fuzzy Hash: 8B61F675A841197AE71496298F0DFEE727CDB62F88F005065F504E5083FF71AF518AE1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697469F7 Relevance: 29.8, APIs: 8, Strings: 9, Instructions: 85libraryloaderCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 1022 697469f7-69746a09 1023 69746a13-69746a28 LoadLibraryA 1022->1023 1024 69746a0b-69746a0e 1022->1024 1026 69746ad4-69746af7 GetLastError call 69746391 1023->1026 1027 69746a2e-69746a65 GetProcAddress * 3 1023->1027 1025 69746aff-69746b01 1024->1025 1034 69746afa-69746afe 1026->1034 1028 69746a67-69746a6d 1027->1028 1029 69746a7c-69746ab4 GetLastError call 69746391 FreeLibrary 1027->1029 1028->1029 1031 69746a6f-69746a71 1028->1031 1037 69746ab6-69746ac8 GetLastError call 69746391 1029->1037 1038 69746acb-69746ad2 1029->1038 1031->1029 1035 69746a73-69746a7a 1031->1035 1034->1025 1035->1034 1037->1038 1038->1034
                                                                                                                              APIs
                                                                                                                              • LoadLibraryA.KERNEL32(sfc.dll), ref: 69746A1B
                                                                                                                              • GetProcAddress.KERNELBASE(00000000,00000008), ref: 69746A37
                                                                                                                              • GetProcAddress.KERNEL32(00000009), ref: 69746A46
                                                                                                                              • GetProcAddress.KERNEL32(SRSetRestorePoint), ref: 69746A58
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$LibraryLoad
                                                                                                                              • String ID: FreeLibrary()$GetProcAddress()$LoadLibrary()$LoadSfcDLL$Module: %s$SRSetRestorePoint$Unable to load %s.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\instcat.cpp$sfc.dll
                                                                                                                              • API String ID: 2238633743-316262473
                                                                                                                              • Opcode ID: e7bc636d1a7261a1b070d8225c2369312ceb44878e4c89b72af04c36ee6109b7
                                                                                                                              • Instruction ID: 07e8469a0996129ce8fd8144444f36f7e413e056d24204c6d2d793520f579e3e
                                                                                                                              • Opcode Fuzzy Hash: e7bc636d1a7261a1b070d8225c2369312ceb44878e4c89b72af04c36ee6109b7
                                                                                                                              • Instruction Fuzzy Hash: 9621FB75A00288FFDFD1BF958E89E7A396CFB62F94B00443AF50193143EB705A608E51
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974B021 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 147COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 1041 6974b021-6974b043 call 697471e9 1044 6974b045 1041->1044 1045 6974b063-6974b06a call 697470ae 1041->1045 1047 6974b04a-6974b04f 1044->1047 1051 6974b073 call 69747157 1045->1051 1052 6974b06c-6974b071 1045->1052 1049 6974b055-6974b061 call 69746b4f 1047->1049 1055 6974b09f-6974b164 call 69746b4f GetWindowsDirectoryA 1049->1055 1056 6974b078-6974b085 1051->1056 1052->1047 1062 6974b166-6974b18d GetLastError call 69746391 1055->1062 1063 6974b18f-6974b1aa call 697485ae call 6974a078 1055->1063 1057 6974b087-6974b08c 1056->1057 1058 6974b08e-6974b09a call 69746b4f 1056->1058 1057->1049 1058->1055 1069 6974b1c7 1062->1069 1072 6974b1ca-6974b1da GetSystemDirectoryA 1063->1072 1073 6974b1ac-6974b1c2 call 69746391 1063->1073 1069->1072 1074 6974b205-6974b214 call 6974a078 1072->1074 1075 6974b1dc-6974b203 GetLastError call 69746391 1072->1075 1073->1069 1081 6974b234-6974b239 1074->1081 1082 6974b216-6974b22c call 69746391 1074->1082 1083 6974b231 1075->1083 1082->1083 1083->1081
                                                                                                                              APIs
                                                                                                                              • GetWindowsDirectoryA.KERNEL32(0000028C,00000104,0000069C,00000104,DirectX.cab,00000598,00000104,directX.inf,?,?,?,6974F10C), ref: 6974B15C
                                                                                                                              • GetLastError.KERNEL32(00000000,?,?,?,6974F10C), ref: 6974B167
                                                                                                                              • GetSystemDirectoryA.KERNEL32(00000390,00000104), ref: 6974B1D2
                                                                                                                              • GetLastError.KERNEL32(00000000,?,?,?,6974F10C), ref: 6974B1DD
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectoryErrorLast$SystemWindows
                                                                                                                              • String ID: CSetup::CSetup$DXNT.cab$DirectX.cab$GetSystemDirectory()$GetWindowsDirectory()$appendSlash() failed.$directX.inf$dxnetsrv.inf$dxnt.inf$dxxp.inf$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 3455926257-880669496
                                                                                                                              • Opcode ID: 460aaf4af2754a9e1e53382523ede9835135c0dada785fef2ee1e0ec1ce1cee8
                                                                                                                              • Instruction ID: 01e0cf42c048181809d1786373eb35be3fc415d571a394cdf5d376503ddd3015
                                                                                                                              • Opcode Fuzzy Hash: 460aaf4af2754a9e1e53382523ede9835135c0dada785fef2ee1e0ec1ce1cee8
                                                                                                                              • Instruction Fuzzy Hash: 015103B0945B409FD370DF6B8A84A9BFBE8BF09B04F80492FA5AED3502D734B5158B11
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A83F72 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 103registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegCreateKeyExA.KERNEL32(80000002,Software\Microsoft\DirectX,00000000,00000000,00000000,00000002,00000000,?,00000000), ref: 00A83F98
                                                                                                                              • RegSetValueExA.KERNEL32(?,command,00000000,00000004,00000001,00000004), ref: 00A83FDA
                                                                                                                              • RegSetValueExA.KERNEL32(?,DXSetup,00000000,00000004,00000001,00000004), ref: 00A83FFF
                                                                                                                              • RegDeleteValueA.ADVAPI32(?,Command), ref: 00A84027
                                                                                                                              • RegCloseKey.KERNEL32(?), ref: 00A84061
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$__wstrtime$CloseCreateDelete_strrchr
                                                                                                                              • String ID: Command$DXSetup$RegCloseKey()$RegCreateKeyEx()$RegDeleteValue()$RegSetValueEx()$SetDXSetupRegValue$Software\Microsoft\DirectX$command$e:\bt\382730\setup\deliverables\dxsetup\dxsetup.cpp
                                                                                                                              • API String ID: 3730219414-2970793184
                                                                                                                              • Opcode ID: 0480d0c804dbb73670bf852da2c5693af8834e9b21e86955a4ce7d422a6352c1
                                                                                                                              • Instruction ID: ab5635fe641e823c67dfef3926744277dea393903e6fca0e7f156244f31aa119
                                                                                                                              • Opcode Fuzzy Hash: 0480d0c804dbb73670bf852da2c5693af8834e9b21e86955a4ce7d422a6352c1
                                                                                                                              • Instruction Fuzzy Hash: 602133F2A80248BEFB107B808DC7EBB397DEB51B95F510828F705F5091D2A44E4687B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974E432 Relevance: 24.7, APIs: 3, Strings: 11, Instructions: 161COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _memset.LIBCMT ref: 6974E4A7
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104,?,dxupdate.cab,?), ref: 6974E4D1
                                                                                                                              • GetLastError.KERNEL32(00000000,?,dxupdate.cab,?), ref: 6974E4DC
                                                                                                                              Strings
                                                                                                                              • %s is not trusted. The file is not signed properly., xrefs: 6974E5D4
                                                                                                                              • CSetup::DXCheckTrust, xrefs: 6974E4E8, 6974E5DF, 6974E60A, 6974E627, 6974E657
                                                                                                                              • %s is not trusted. The file may be damaged. Please check valid certificate is installed and Cryptographic Services are enabled., xrefs: 6974E5FF
                                                                                                                              • %s is not trusted due to certificate problem. Please check valid certificate is installed and Cryptographic Services are enabled., xrefs: 6974E61C
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp, xrefs: 6974E4F2, 6974E631, 6974E661
                                                                                                                              • Unable to initialize CWinTrust., xrefs: 6974E650
                                                                                                                              • dxupdate.cab, xrefs: 6974E467
                                                                                                                              • 0, xrefs: 6974E52B
                                                                                                                              • MultiByteToWideChar(), xrefs: 6974E4E3
                                                                                                                              • DXCheckTrust(): %s is trusted., xrefs: 6974E5B4
                                                                                                                              • WinVerifyTrust(), xrefs: 6974E5DA, 6974E605, 6974E622
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharErrorLastMultiWide_memset
                                                                                                                              • String ID: %s is not trusted due to certificate problem. Please check valid certificate is installed and Cryptographic Services are enabled.$%s is not trusted. The file is not signed properly.$%s is not trusted. The file may be damaged. Please check valid certificate is installed and Cryptographic Services are enabled.$0$CSetup::DXCheckTrust$DXCheckTrust(): %s is trusted.$MultiByteToWideChar()$Unable to initialize CWinTrust.$WinVerifyTrust()$dxupdate.cab$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 1545292163-1626623308
                                                                                                                              • Opcode ID: fb4d80ca6f4b5505093e7c55074533800f698611f03a34f295cdcf734152b347
                                                                                                                              • Instruction ID: 2f8c1ba5de87ab5d49d0eb83e8d4162d7e4aebbc14061b5e4245e7937163413f
                                                                                                                              • Opcode Fuzzy Hash: fb4d80ca6f4b5505093e7c55074533800f698611f03a34f295cdcf734152b347
                                                                                                                              • Instruction Fuzzy Hash: D051A87594421CBBDB20DF588E8CABDB3B8BF04F14F5045AAE518B6183EB305B849F61
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974E72A Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 101synchronizationCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • OutputDebugStringA.KERNELBASE(DLL_PROCESS_ATTACH), ref: 6974E74B
                                                                                                                                • Part of subcall function 6974B021: GetWindowsDirectoryA.KERNEL32(0000028C,00000104,0000069C,00000104,DirectX.cab,00000598,00000104,directX.inf,?,?,?,6974F10C), ref: 6974B15C
                                                                                                                                • Part of subcall function 6974B021: GetLastError.KERNEL32(00000000,?,?,?,6974F10C), ref: 6974B167
                                                                                                                                • Part of subcall function 6974B021: GetSystemDirectoryA.KERNEL32(00000390,00000104), ref: 6974B1D2
                                                                                                                                • Part of subcall function 6974B021: GetLastError.KERNEL32(00000000,?,?,?,6974F10C), ref: 6974B1DD
                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,DSETUP32 DLL Mutex), ref: 6974E78A
                                                                                                                              • GetLastError.KERNEL32 ref: 6974E79C
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 6974E7C5
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6974E7D0
                                                                                                                              • OutputDebugStringA.KERNELBASE(DLL_PROCESS_DETACH), ref: 6974E7F3
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 6974E81B
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6974E826
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$CloseDebugDirectoryHandleOutputString$CreateMutexSystemWindows
                                                                                                                              • String ID: CloseHandle()$DLL_PROCESS_ATTACH$DLL_PROCESS_DETACH$DSETUP32 DLL Mutex$DllMain$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 3404843948-3774820900
                                                                                                                              • Opcode ID: 492de6dc9d726d6d8b2e7ec6d9ebc69d962958ae662c331e5ad718b387a2be23
                                                                                                                              • Instruction ID: ab8b7c1001cbca4b9d90ca63441b639a31868659d083f0dc71489a707bfd7dc9
                                                                                                                              • Opcode Fuzzy Hash: 492de6dc9d726d6d8b2e7ec6d9ebc69d962958ae662c331e5ad718b387a2be23
                                                                                                                              • Instruction Fuzzy Hash: F9318F75644288FBCB80FF798E8C9393AA8FF96F75740883AE511D3113EB30A8118E51
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974D7A8 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 95COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 6974D7DC
                                                                                                                              • GetCurrentProcess.KERNEL32(?,00000000,00000000,WinNT@64), ref: 6974D84B
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6974D86E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CurrentErrorLastProcessVersion
                                                                                                                              • String ID: ($IsWow64$IsWow64(): Windows 2000 or Windows 9x.$IsWow64(): not Wow64 process.$IsWow64(): running on Wow64.$IsWow64Process()$Unable to initialize CKernel32.$WinNT@64$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 722992446-1906961222
                                                                                                                              • Opcode ID: e7624a77e3e79116568dba45368dc0d1379fcd5d55f4e7a8ea7d68462de784f8
                                                                                                                              • Instruction ID: 21090d9d6e25041ed8f1ba55df1bf3d3c5ae7f293b1081383225cffedb4ea893
                                                                                                                              • Opcode Fuzzy Hash: e7624a77e3e79116568dba45368dc0d1379fcd5d55f4e7a8ea7d68462de784f8
                                                                                                                              • Instruction Fuzzy Hash: 9831E835944214EBDB60AB788F49FAD73BC9B86F25F10457BE448A2083DB706584CB1E
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697467A1 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 79COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetFileVersionInfoSizeA.VERSION(69746892,?,\ntkrnlpa.exe,00000104,00000000,?,?,69746892,?,?,?,00000000), ref: 697467B2
                                                                                                                                • Part of subcall function 697466FB: _strrchr.LIBCMT ref: 69746706
                                                                                                                              • GetLastError.KERNEL32(69746892,69746892,?,\ntkrnlpa.exe,00000104,00000000,?,?,69746892,?,?,?,00000000), ref: 697467C9
                                                                                                                              • _memset.LIBCMT ref: 69746821
                                                                                                                              • GetFileVersionInfoA.VERSION(69746892,00000000,00000000,00000000,?,69746892,?,?,?,00000000), ref: 6974682F
                                                                                                                              • GetLastError.KERNEL32(00000000,69746892,00000000,00000000,00000000,?,69746892,?,?,?,00000000), ref: 69746839
                                                                                                                              Strings
                                                                                                                              • Unable to allocate memory., xrefs: 697467FE
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 6974680F, 6974684F
                                                                                                                              • GetFileVersionInfo(), xrefs: 69746840
                                                                                                                              • GetFileVersionInfoBlock(): %s does not have version information., xrefs: 697467E1
                                                                                                                              • GetFileVersionInfoBlock(): Unable to get FileVersionInfoSize, file: %s, reason: %d., xrefs: 697467D1
                                                                                                                              • \ntkrnlpa.exe, xrefs: 697467AC
                                                                                                                              • GetFileVersionInfoBlock, xrefs: 69746805, 69746845
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileInfoLastVersion$Size_memset_strrchr
                                                                                                                              • String ID: GetFileVersionInfo()$GetFileVersionInfoBlock$GetFileVersionInfoBlock(): %s does not have version information.$GetFileVersionInfoBlock(): Unable to get FileVersionInfoSize, file: %s, reason: %d.$Unable to allocate memory.$\ntkrnlpa.exe$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 388213077-426275582
                                                                                                                              • Opcode ID: 499ee1b9e5a9bee5476c734485ee792330452c2423077dc875e02ac38a4ed91b
                                                                                                                              • Instruction ID: b1169f0ef2a2500fdfbcbe286ab36f10df0917f8991549dfb4667d555b1fd618
                                                                                                                              • Opcode Fuzzy Hash: 499ee1b9e5a9bee5476c734485ee792330452c2423077dc875e02ac38a4ed91b
                                                                                                                              • Instruction Fuzzy Hash: 5D11E9AA544114BAD2117AA58F89CDF361CCAA3FDC7449032F900B9103FF20CF2485B7
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A84090 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 73registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\DirectX,00000000,00000002,?), ref: 00A840AA
                                                                                                                              • RegDeleteValueA.KERNEL32(?,DXSetup), ref: 00A840C1
                                                                                                                              • RegDeleteValueA.KERNEL32(?,Command), ref: 00A840FA
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00A8411F
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DeleteValue__wstrtime$CloseOpen_strrchr
                                                                                                                              • String ID: Command$DXSetup$DelDXSetupRegValue$RegCloseKey().$RegDeleteValue()$RegOpenKeyEx()$Software\Microsoft\DirectX$e:\bt\382730\setup\deliverables\dxsetup\dxsetup.cpp
                                                                                                                              • API String ID: 1208366470-3975958792
                                                                                                                              • Opcode ID: d9a555367167c2c1e92ffbc0d14a7ceeefd25ad6895d33f621b3f9366bacbcca
                                                                                                                              • Instruction ID: b4cc6ccc77d2fae27b31e9964d86a7304806a6b814d819194b24fdaf1246fa36
                                                                                                                              • Opcode Fuzzy Hash: d9a555367167c2c1e92ffbc0d14a7ceeefd25ad6895d33f621b3f9366bacbcca
                                                                                                                              • Instruction Fuzzy Hash: 1C115E72B803057AEB2077915C0BFAB396DEBA5B91F640928FE05F50D2E6908E42C765
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A84C60 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 73COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleFileNameA.KERNELBASE(?,00000104), ref: 00A84C87
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 00A84C92
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              • _strrchr.LIBCMT ref: 00A84CC6
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime_strrchr$ErrorFileLastModuleName
                                                                                                                              • String ID: GetModuleFileName()$IsFlatImage$IsFlatImage(): TRUE.$IsFlatImage(): path does not have back slash.$directx.cab$directx.inf$dxnt.cab$dxntunp.inf$e:\bt\382730\setup\deliverables\dxsetup\dxsetup.cpp
                                                                                                                              • API String ID: 3943934939-995788670
                                                                                                                              • Opcode ID: 5eeed6fa933b2494d703fc105446b1eef9ff6f1213d2c41c4472a93338ccace8
                                                                                                                              • Instruction ID: b5f3035dd6e76ca3d5ff186468bebda2434ea95422fda0434a7b8ae2b23bab1a
                                                                                                                              • Opcode Fuzzy Hash: 5eeed6fa933b2494d703fc105446b1eef9ff6f1213d2c41c4472a93338ccace8
                                                                                                                              • Instruction Fuzzy Hash: 5A21D6B56843067AEB10F7B5DD42EEA33ECAB18744F400865F985D60C1EFA4CA854721
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C094F9C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 60synchronizationCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,***DirectXSetupA***), ref: 6C094FC2
                                                                                                                              • GetLastError.KERNEL32 ref: 6C094FCE
                                                                                                                              • iDirectXSetup.DSETUP32(?,?), ref: 6C095008
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 6C09501A
                                                                                                                              • GetLastError.KERNEL32(Not fatal...), ref: 6C095029
                                                                                                                              Strings
                                                                                                                              • DirectXSetupA(): hWnd: %08X dwFlags: %08X, xrefs: 6C094FAC
                                                                                                                              • DirectXSetupA, xrefs: 6C095035
                                                                                                                              • Not fatal..., xrefs: 6C095024
                                                                                                                              • CloseHandle(), xrefs: 6C095030
                                                                                                                              • ***DirectXSetupA***, xrefs: 6C094FB9
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c, xrefs: 6C09503F
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$CloseCreateDirectHandleMutexSetup
                                                                                                                              • String ID: ***DirectXSetupA***$CloseHandle()$DirectXSetupA$DirectXSetupA(): hWnd: %08X dwFlags: %08X$Not fatal...$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 1105574552-1566507652
                                                                                                                              • Opcode ID: c22d0c0d66001b832f56ed21887347f8512d242ab1c732a7bf4907b49f2e3601
                                                                                                                              • Instruction ID: f63e9872fc55dd84061faac0a6f5cc696010c27ce6c0740b84493255bcaa1301
                                                                                                                              • Opcode Fuzzy Hash: c22d0c0d66001b832f56ed21887347f8512d242ab1c732a7bf4907b49f2e3601
                                                                                                                              • Instruction Fuzzy Hash: 9B11C836705611B7DF001ED79C04F9E7AFCBB86759F106121FA1AD6951DB60D40076E1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69758CF7 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 520fileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __get_daylight.LIBCMT ref: 69758D39
                                                                                                                              • __get_wpgmptr.LIBCMT ref: 69758D54
                                                                                                                              • CreateFileA.KERNELBASE(69747D8D,00000080,69747D8D,0000000C,00000001,00000080,00000000), ref: 69758F2B
                                                                                                                              • GetLastError.KERNEL32 ref: 69758F53
                                                                                                                              • __dosmaperr.LIBCMT ref: 69758F5A
                                                                                                                              • GetFileType.KERNELBASE ref: 69758F6D
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 69758F93
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 69758FBF
                                                                                                                              • __locking.LIBCMT ref: 697592B3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseFileHandle$CreateErrorLastType__dosmaperr__get_daylight__get_wpgmptr__locking
                                                                                                                              • String ID: @
                                                                                                                              • API String ID: 690964824-2766056989
                                                                                                                              • Opcode ID: da7e13df28870534447224831cc3233fdf8bea4cfb2c04c6ab000690eb3e3076
                                                                                                                              • Instruction ID: b7192f3bcadb6e68d826037356c1bcf7612d058cbf3867e73180449d22ba3826
                                                                                                                              • Opcode Fuzzy Hash: da7e13df28870534447224831cc3233fdf8bea4cfb2c04c6ab000690eb3e3076
                                                                                                                              • Instruction Fuzzy Hash: 070242B1E042499BEB818F68CE857AD7BB4FB11358F648A39D463D71E0DF3589A4CB01
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8FF67 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 520fileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __get_daylight.LIBCMT ref: 00A8FFA9
                                                                                                                              • __get_wpgmptr.LIBCMT ref: 00A8FFC4
                                                                                                                              • CreateFileA.KERNELBASE(?,00000080,?,0000000C,00000001,00000080,00000000), ref: 00A9019B
                                                                                                                              • GetLastError.KERNEL32 ref: 00A901C3
                                                                                                                              • __dosmaperr.LIBCMT ref: 00A901CA
                                                                                                                              • GetFileType.KERNELBASE ref: 00A901DD
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00A90203
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00A9022F
                                                                                                                              • __locking.LIBCMT ref: 00A90523
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseFileHandle$CreateErrorLastType__dosmaperr__get_daylight__get_wpgmptr__locking
                                                                                                                              • String ID: @
                                                                                                                              • API String ID: 690964824-2766056989
                                                                                                                              • Opcode ID: 30882d027b274d2453104d8a1937d185ba05c4ffdd5326f3a09ede48c129c72d
                                                                                                                              • Instruction ID: f6dd1c540946eb68271a2b5eb4c44022f4664275bab4c2cc4b2ed727f56260c7
                                                                                                                              • Opcode Fuzzy Hash: 30882d027b274d2453104d8a1937d185ba05c4ffdd5326f3a09ede48c129c72d
                                                                                                                              • Instruction Fuzzy Hash: 01022471A00249DFEF219F68CC86FAE7BF0EB01394F24466AE6619B1E1D7358D84CB51
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A84B1B Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 112stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              • CharLowerA.USER32 ref: 00A84BC6
                                                                                                                              • lstrcmpi.KERNEL32(00000000,00A98000), ref: 00A84BE5
                                                                                                                              • _strtok.LIBCMT ref: 00A84C24
                                                                                                                                • Part of subcall function 00A87D7D: __getptd.LIBCMT ref: 00A87D9B
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$CharLower__getptd_strrchr_strtoklstrcmpi
                                                                                                                              • String ID: CommandLine: %s$No command line switch$ParseCommandLine$StringCchCopyA()$Unable to allocate memory block.$Unable to copy string %s.$e:\bt\382730\setup\deliverables\dxsetup\dxsetup.cpp
                                                                                                                              • API String ID: 1047108780-590517559
                                                                                                                              • Opcode ID: 3571f53f3a14d6e736071981ef41771f8e5c53bd7bf3c9456a4cc1376721e9de
                                                                                                                              • Instruction ID: c91af414b92281995819dcd4a19b24ab41bff99b8d3cf3bbee6ec98dc5df5134
                                                                                                                              • Opcode Fuzzy Hash: 3571f53f3a14d6e736071981ef41771f8e5c53bd7bf3c9456a4cc1376721e9de
                                                                                                                              • Instruction Fuzzy Hash: 9831D2F2905206BFDB20BF90CC89E6E7EBCEB58754F20082AF506A6140E671DD81CB61
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69749F49 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetFileAttributesA.KERNELBASE(00000104,00000000), ref: 69749F63
                                                                                                                              • GetLastError.KERNEL32 ref: 69749F6E
                                                                                                                              • _strnlen.LIBCMT ref: 69749FCF
                                                                                                                              • SHFileOperationA.SHELL32(?,?,00000104,00000104,?,00000104), ref: 6974A020
                                                                                                                              • DeleteFileA.KERNELBASE(00000104,?,00000104), ref: 6974A02F
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              • GetLastError.KERNEL32(Unable to remove %s.,00000104,?,00000104), ref: 6974A041
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$ErrorLast__wstrtime$AttributesDeleteOperation_strnlen_strrchr
                                                                                                                              • String ID: DXRemoveFile$GetFileAttributes()$Unable to remove %s.$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 3110083123-1900097680
                                                                                                                              • Opcode ID: 57f86ef8f638c583aa35defdda666c93237a48c1dd9cac4320a7da9b881c0a2c
                                                                                                                              • Instruction ID: 20dd4a77558e1bfd98eca53deb203b786c29667e6c2d983bc847a84970780a47
                                                                                                                              • Opcode Fuzzy Hash: 57f86ef8f638c583aa35defdda666c93237a48c1dd9cac4320a7da9b881c0a2c
                                                                                                                              • Instruction Fuzzy Hash: A821F571900258ABDB10AFA48E45BDDB7B8EF1AF58F5041B6E648E7142F6305F508FA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69749A79 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleFileNameA.KERNEL32(?,?,00000104,?), ref: 69749AA4
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 69749AAF
                                                                                                                              • GetShortPathNameA.KERNEL32 ref: 69749AE0
                                                                                                                              • _strnlen.LIBCMT ref: 69749AF2
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 69749B00
                                                                                                                              • _strnlen.LIBCMT ref: 69749B1E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastName_strnlen$FileModulePathShort
                                                                                                                              • String ID: GetModuleFileName()$GetShortPathName()$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h$getWorkingDirectory
                                                                                                                              • API String ID: 1941469614-905520932
                                                                                                                              • Opcode ID: 2810ee1ef971399a13532b7c75ec3124109bc4696f726c4a056f7cf94e4b90e4
                                                                                                                              • Instruction ID: 61a47f54fdcf431dcee010a2c0b37fd37125ab385270a62df7fa766be03ea2f5
                                                                                                                              • Opcode Fuzzy Hash: 2810ee1ef971399a13532b7c75ec3124109bc4696f726c4a056f7cf94e4b90e4
                                                                                                                              • Instruction Fuzzy Hash: B0210735644245AFEB40AA748F89FFF7BADEB62F54F40002AF955E2143FE209600C661
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69746872 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 62COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _memset.LIBCMT ref: 69746882
                                                                                                                                • Part of subcall function 697467A1: GetFileVersionInfoSizeA.VERSION(69746892,?,\ntkrnlpa.exe,00000104,00000000,?,?,69746892,?,?,?,00000000), ref: 697467B2
                                                                                                                                • Part of subcall function 697467A1: GetLastError.KERNEL32(69746892,69746892,?,\ntkrnlpa.exe,00000104,00000000,?,?,69746892,?,?,?,00000000), ref: 697467C9
                                                                                                                              • VerQueryValueW.VERSION(00000000,69741754,00000000,?,?,?,?,00000000), ref: 697468AA
                                                                                                                              • GetLastError.KERNEL32(00000000,00000000,69741754,00000000,?,?,?,?,00000000), ref: 697468B4
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$FileInfoQuerySizeValueVersion_memset
                                                                                                                              • String ID: 4$DXGetFileVersion$Data size mismatch.$VerQueryValue()$\ntkrnlpa.exe$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 2833552196-2675559974
                                                                                                                              • Opcode ID: c39d2688cbdc4240e8a7980611797020ef0716b079fb986a854ecdfcf043da3a
                                                                                                                              • Instruction ID: 158e92a527d50de0816b7b43a08bee07de05dc8c5221347d28e0b30ac3679dfa
                                                                                                                              • Opcode Fuzzy Hash: c39d2688cbdc4240e8a7980611797020ef0716b079fb986a854ecdfcf043da3a
                                                                                                                              • Instruction Fuzzy Hash: 51019675640208BAEB027A94DF86F9E371CDBA1F9CF508035BA01A9043EB71AB259566
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974B4E4 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 80COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 6974B518
                                                                                                                              • GetNativeSystemInfo.KERNEL32(?), ref: 6974B57F
                                                                                                                              Strings
                                                                                                                              • IsIA64(): Windows 2000 or Windows 9x, xrefs: 6974B540
                                                                                                                              • Unable to initialize CKernel32., xrefs: 6974B5BC
                                                                                                                              • (, xrefs: 6974B534
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp, xrefs: 6974B5CF
                                                                                                                              • IsIA64(): IA64., xrefs: 6974B59D
                                                                                                                              • IsIA64, xrefs: 6974B5C5
                                                                                                                              • IsIA64(): not IA64., xrefs: 6974B5AD
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: InfoNativeSystemVersion
                                                                                                                              • String ID: ($IsIA64$IsIA64(): IA64.$IsIA64(): Windows 2000 or Windows 9x$IsIA64(): not IA64.$Unable to initialize CKernel32.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 2296905803-181654248
                                                                                                                              • Opcode ID: 3cf71509e40d71171aaf25890a1270588239fbbafd77fc213402a24e5c170e88
                                                                                                                              • Instruction ID: 1decef71b89410301653ff960c3e5b307abb759e818a466dcda780a330d6fc1e
                                                                                                                              • Opcode Fuzzy Hash: 3cf71509e40d71171aaf25890a1270588239fbbafd77fc213402a24e5c170e88
                                                                                                                              • Instruction Fuzzy Hash: 93213B30948214EADB60DB788F09B8DF3B59B05F24F608579E419E21C3EF706F848B55
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A86EC2 Relevance: 15.1, APIs: 10, Instructions: 108COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00A8935E: GetModuleHandleA.KERNEL32(00000000), ref: 00A89365
                                                                                                                              • GetStartupInfoA.KERNEL32 ref: 00A86EED
                                                                                                                              • GetVersionExA.KERNEL32(00000094), ref: 00A86F0B
                                                                                                                              • _fast_error_exit.LIBCMT ref: 00A86F81
                                                                                                                              • _fast_error_exit.LIBCMT ref: 00A86F92
                                                                                                                              • __amsg_exit.LIBCMT ref: 00A86FA6
                                                                                                                              • GetCommandLineA.KERNEL32 ref: 00A86FAC
                                                                                                                              • ___crtGetEnvironmentStringsA.LIBCMT ref: 00A86FB7
                                                                                                                              • __amsg_exit.LIBCMT ref: 00A86FCC
                                                                                                                              • __amsg_exit.LIBCMT ref: 00A86FDD
                                                                                                                              • __amsg_exit.LIBCMT ref: 00A86FEF
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentHandleInfoLineModuleStartupStringsVersion___crt
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4221928475-0
                                                                                                                              • Opcode ID: 8260a62b2ac82db2801aef5b3bf8ea53828b7f023080e8101e382395b4dca158
                                                                                                                              • Instruction ID: 6de9871a9148edc4fa1b9635c87006d6257a619cf093c73d6b2c9f98448588d3
                                                                                                                              • Opcode Fuzzy Hash: 8260a62b2ac82db2801aef5b3bf8ea53828b7f023080e8101e382395b4dca158
                                                                                                                              • Instruction Fuzzy Hash: B331A571A143059AEB24FFB4EE46B6E76B8AF05310F24059AF205AA1D2DF78CD818B11
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09F7A6 Relevance: 14.0, APIs: 9, Instructions: 520fileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __get_daylight.LIBCMT ref: 6C09F7E8
                                                                                                                              • __get_wpgmptr.LIBCMT ref: 6C09F803
                                                                                                                              • CreateFileA.KERNELBASE(00000000,00000080,00000000,0000000C,00000001,00000080,00000000), ref: 6C09F9DA
                                                                                                                              • GetLastError.KERNEL32 ref: 6C09FA02
                                                                                                                              • __dosmaperr.LIBCMT ref: 6C09FA09
                                                                                                                              • GetFileType.KERNELBASE ref: 6C09FA1C
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 6C09FA42
                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 6C09FA6E
                                                                                                                              • __locking.LIBCMT ref: 6C09FD62
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseFileHandle$CreateErrorLastType__dosmaperr__get_daylight__get_wpgmptr__locking
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 690964824-0
                                                                                                                              • Opcode ID: eb0677fafa024fe7925919f98141bde8ef0e11b4e7549d33b1b5c664f7397383
                                                                                                                              • Instruction ID: ff2853fec8a51c866b7ca910266c7a2ca892598165d9d84de1fb16f6ea393daf
                                                                                                                              • Opcode Fuzzy Hash: eb0677fafa024fe7925919f98141bde8ef0e11b4e7549d33b1b5c664f7397383
                                                                                                                              • Instruction Fuzzy Hash: 0F022571905609AFEF118F68CC817AE7BF9EB0231CF246669F460DBAE0D7758944EB01
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697572DE Relevance: 14.0, APIs: 9, Instructions: 502COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 4df8814bc1fdfb6fd6fcb500637ab99cdf90724f6f94c8dcd2253df711860a3b
                                                                                                                              • Instruction ID: e64e35dc5d9a96c1f40dea915418b12a6c2a4a1e276b29f6670c5d70105590b5
                                                                                                                              • Opcode Fuzzy Hash: 4df8814bc1fdfb6fd6fcb500637ab99cdf90724f6f94c8dcd2253df711860a3b
                                                                                                                              • Instruction Fuzzy Hash: 3412C070A04286CFDB91CF68CA857AE7BB1FF42304F14C9A9D4639B2A1DF709561CB52
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0A1689 Relevance: 14.0, APIs: 9, Instructions: 502COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 9744732a8913fc19ef8a2f7418bdc442d579ffa1add08d2109f855382ed55a1f
                                                                                                                              • Instruction ID: fdacccb728a90de1527d1ff0ac0f38a1cc0dc3f0d5329b03aa291675e2b03977
                                                                                                                              • Opcode Fuzzy Hash: 9744732a8913fc19ef8a2f7418bdc442d579ffa1add08d2109f855382ed55a1f
                                                                                                                              • Instruction Fuzzy Hash: CC120471A08285DFDB11CFE8C8407AEBBF5BF42308F184699E4A19BA92D770D547CB52
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974F250 Relevance: 13.6, APIs: 9, Instructions: 127COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 6974F284
                                                                                                                              • __heap_term.LIBCMT ref: 6974F2F5
                                                                                                                              • GetCommandLineA.KERNEL32 ref: 6974F2FC
                                                                                                                              • ___crtGetEnvironmentStringsA.LIBCMT ref: 6974F307
                                                                                                                                • Part of subcall function 69751F9B: GetEnvironmentStringsW.KERNEL32(?,?,?,6974F30C), ref: 69751FB9
                                                                                                                                • Part of subcall function 69751F9B: GetEnvironmentStringsW.KERNEL32(?,?,?,6974F30C), ref: 69751FF4
                                                                                                                                • Part of subcall function 69751957: GetStartupInfoA.KERNEL32 ref: 6975196C
                                                                                                                                • Part of subcall function 69751957: GetFileType.KERNEL32 ref: 69751A7A
                                                                                                                                • Part of subcall function 69751957: ___crtInitCritSecAndSpinCount.LIBCMT ref: 69751AAE
                                                                                                                              • __mtterm.LIBCMT ref: 6974F31A
                                                                                                                                • Part of subcall function 6975130C: TlsFree.KERNEL32(00000019,6974F385), ref: 69751337
                                                                                                                                • Part of subcall function 6975130C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6974F385), ref: 69754901
                                                                                                                                • Part of subcall function 6975130C: DeleteCriticalSection.KERNEL32(00000019,?,?,6974F385), ref: 6975492B
                                                                                                                              • __mtterm.LIBCMT ref: 6974F380
                                                                                                                              • __heap_term.LIBCMT ref: 6974F385
                                                                                                                              • ___set_flsgetvalue.LIBCMT ref: 6974F391
                                                                                                                                • Part of subcall function 697512DD: TlsGetValue.KERNEL32 ref: 697512E3
                                                                                                                                • Part of subcall function 697512DD: TlsSetValue.KERNEL32(00000000,?,6974FCAF,69747D8D,?,?,6974770E,00066BDC,?,?,00000000,?,?,697477A6,SETUP_AGREEMENT_ENG,000012F1), ref: 69751300
                                                                                                                                • Part of subcall function 69751911: __calloc_impl.LIBCMT ref: 69751926
                                                                                                                                • Part of subcall function 6975037B: ___sbh_find_block.LIBCMT ref: 697503A4
                                                                                                                                • Part of subcall function 6975037B: HeapFree.KERNEL32(00000000,69747D8D,6975B418), ref: 697503E3
                                                                                                                                • Part of subcall function 6975037B: GetLastError.KERNEL32(?,6975186F,00000004,6975B500,0000000C,697581A1,69747D8D,00066BDB,00000000,00000000,00000000,?,6975143E,00000001,00000214), ref: 697503F4
                                                                                                                              • __freeptd.LIBCMT ref: 6974F3E3
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: EnvironmentStrings$CriticalDeleteFreeSectionValue___crt__heap_term__mtterm$CommandCountCritErrorFileHeapInfoInitLastLineSpinStartupTypeVersion___sbh_find_block___set_flsgetvalue__calloc_impl__freeptd
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4055056290-0
                                                                                                                              • Opcode ID: 0aedaae6b65fd54f72989526290a4a509a9c0dc8e0797c29966fdd694746b483
                                                                                                                              • Instruction ID: 9debd8e4a743ef961ad8e8c77461a3982251338ed0ff80e085ecd402381d6541
                                                                                                                              • Opcode Fuzzy Hash: 0aedaae6b65fd54f72989526290a4a509a9c0dc8e0797c29966fdd694746b483
                                                                                                                              • Instruction Fuzzy Hash: 5541D039A48245DADBD4EFB18B49A2D33E4AF06B5AF10A43AD806D2142EF30D451DF66
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0967A9 Relevance: 13.6, APIs: 9, Instructions: 127COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 6C0967DD
                                                                                                                              • __heap_term.LIBCMT ref: 6C09684E
                                                                                                                              • GetCommandLineA.KERNEL32 ref: 6C096855
                                                                                                                              • ___crtGetEnvironmentStringsA.LIBCMT ref: 6C096860
                                                                                                                                • Part of subcall function 6C0987C4: GetEnvironmentStringsW.KERNEL32(?,?,?,6C096865), ref: 6C0987E2
                                                                                                                                • Part of subcall function 6C0987C4: GetEnvironmentStringsW.KERNEL32(?,?,?,6C096865), ref: 6C09881D
                                                                                                                                • Part of subcall function 6C098180: GetStartupInfoA.KERNEL32 ref: 6C098195
                                                                                                                                • Part of subcall function 6C098180: GetFileType.KERNEL32 ref: 6C0982A3
                                                                                                                                • Part of subcall function 6C098180: ___crtInitCritSecAndSpinCount.LIBCMT ref: 6C0982D7
                                                                                                                              • __mtterm.LIBCMT ref: 6C096873
                                                                                                                                • Part of subcall function 6C097B35: TlsFree.KERNEL32(0000000C,6C0968DE), ref: 6C097B60
                                                                                                                                • Part of subcall function 6C097B35: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6C0968DE), ref: 6C09ACB6
                                                                                                                                • Part of subcall function 6C097B35: DeleteCriticalSection.KERNEL32(0000000C,?,?,6C0968DE), ref: 6C09ACE0
                                                                                                                              • __mtterm.LIBCMT ref: 6C0968D9
                                                                                                                              • __heap_term.LIBCMT ref: 6C0968DE
                                                                                                                              • ___set_flsgetvalue.LIBCMT ref: 6C0968EA
                                                                                                                                • Part of subcall function 6C097B06: TlsGetValue.KERNEL32 ref: 6C097B0C
                                                                                                                                • Part of subcall function 6C097B06: TlsSetValue.KERNEL32(00000000), ref: 6C097B29
                                                                                                                                • Part of subcall function 6C09813A: __calloc_impl.LIBCMT ref: 6C09814F
                                                                                                                                • Part of subcall function 6C096F02: ___sbh_find_block.LIBCMT ref: 6C096F2B
                                                                                                                                • Part of subcall function 6C096F02: HeapFree.KERNEL32(00000000,00000000,6C0A26A0), ref: 6C096F6A
                                                                                                                                • Part of subcall function 6C096F02: GetLastError.KERNEL32(?,6C098098,00000004,6C0A2788,0000000C,6C09DAD8,00000000,00000000,00000000,00000000,00000000,?,6C097C67,00000001,00000214), ref: 6C096F7B
                                                                                                                              • __freeptd.LIBCMT ref: 6C09693C
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: EnvironmentStrings$CriticalDeleteFreeSectionValue___crt__heap_term__mtterm$CommandCountCritErrorFileHeapInfoInitLastLineSpinStartupTypeVersion___sbh_find_block___set_flsgetvalue__calloc_impl__freeptd
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4055056290-0
                                                                                                                              • Opcode ID: 6cb92c4e782e7b02681793f1e97e7a22073ea26047503f8b58ddd4e9d44c1f19
                                                                                                                              • Instruction ID: 1f0bdbcb68ffe1ed2a32be6522e205a95db05256a664bb115c621c7d3e2a16a9
                                                                                                                              • Opcode Fuzzy Hash: 6cb92c4e782e7b02681793f1e97e7a22073ea26047503f8b58ddd4e9d44c1f19
                                                                                                                              • Instruction Fuzzy Hash: D7412932609614AADB919BB59800B8E72F8BF8235CF20766BC414C3B51DF70D549BA91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69753A6B Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 221COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fassign__wsopen_s
                                                                                                                              • String ID: $UNICODE$UTF-16LE$UTF-8$ccs=
                                                                                                                              • API String ID: 2488987356-1656882147
                                                                                                                              • Opcode ID: 92e4df6f8903ca49ba0f9e3152f5fc2f6b6697931154d096e71b6597daacb01e
                                                                                                                              • Instruction ID: 92e7da99f2b63c5f55dbe25bce774ac6fb50825703f9af25ce948cf26b9d6342
                                                                                                                              • Opcode Fuzzy Hash: 92e4df6f8903ca49ba0f9e3152f5fc2f6b6697931154d096e71b6597daacb01e
                                                                                                                              • Instruction Fuzzy Hash: AA71A1B1C08249EAEB918F598B45799BFB0BF01364F10C47DE867961B1EF79C2A19F40
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8ADF7 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 221COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fassign__wsopen_s
                                                                                                                              • String ID: $UNICODE$UTF-16LE$UTF-8$ccs=
                                                                                                                              • API String ID: 2488987356-1656882147
                                                                                                                              • Opcode ID: 6767a39c4b23aadfa4d3e90a903af09d75afc3da048e2e87e914d01a222f1fd7
                                                                                                                              • Instruction ID: 7d4a9d3c3c1a04ccac3f0b7900cead837cf0e947952ba40482fa3b6b0118604a
                                                                                                                              • Opcode Fuzzy Hash: 6767a39c4b23aadfa4d3e90a903af09d75afc3da048e2e87e914d01a222f1fd7
                                                                                                                              • Instruction Fuzzy Hash: D07103B1804209AEFF25BF59C4057AA7BB0EF21314F24C46FEA6696191D3B88F41DF52
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09C506 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 221COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fassign__wsopen_s
                                                                                                                              • String ID: UNICODE$UTF-16LE$UTF-8$`"l$ccs=
                                                                                                                              • API String ID: 2488987356-2255523370
                                                                                                                              • Opcode ID: 5a0318d615395672dcfb0f6419f233dade6eed9e2d4ada7d4fa3c4bbcd8aa44b
                                                                                                                              • Instruction ID: d9568f7bd0a52c1b16347fa62f04b35f20205e3131f8ba075c516f4d4b5a095e
                                                                                                                              • Opcode Fuzzy Hash: 5a0318d615395672dcfb0f6419f233dade6eed9e2d4ada7d4fa3c4bbcd8aa44b
                                                                                                                              • Instruction Fuzzy Hash: 0D7115B1C09249AEDB00AF6A844439DBFF8AF0631CF50F02AE869A6E51D3758741FF50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69746DAB Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 78COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 69746DE7
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectorySystem
                                                                                                                              • String ID: DXGetFileVersion() failed.$FRunningOnWinXP$GetSystemDirectory()$\ntkrnlpa.exe$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h
                                                                                                                              • API String ID: 2188284642-531677455
                                                                                                                              • Opcode ID: 8b52b7d269e0866c3a8c138c048c42cd8705befbfadd659d2017b9e189c5f2c4
                                                                                                                              • Instruction ID: 1d82188f41c95034b9f4206580bfe198649d4b95bd7818d2f5ebc6dcf059ad7a
                                                                                                                              • Opcode Fuzzy Hash: 8b52b7d269e0866c3a8c138c048c42cd8705befbfadd659d2017b9e189c5f2c4
                                                                                                                              • Instruction Fuzzy Hash: 4321F675E40258A7DB90E668CF04FDF33ECAB56F55F400476B504E2082EA70EB94CB54
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69746EAF Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 73COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 69746EEB
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectorySystem
                                                                                                                              • String ID: DXGetFileVersion() failed.$FRunningOnNETServer$GetSystemDirectory()$\ntkrnlpa.exe$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h
                                                                                                                              • API String ID: 2188284642-3175186359
                                                                                                                              • Opcode ID: 29d64efc4ff79c92cc744143e3f3806979a3ae1c9bdd5800c4bae99f3f7e7e6d
                                                                                                                              • Instruction ID: a771433796f182e6357edae9e98feb29cbabc4466449b787bbd2cdf1cbc01f7b
                                                                                                                              • Opcode Fuzzy Hash: 29d64efc4ff79c92cc744143e3f3806979a3ae1c9bdd5800c4bae99f3f7e7e6d
                                                                                                                              • Instruction Fuzzy Hash: 8E210679A44244ABDB40E664CE44FDA33BC9B59F15F8000B6B448E2083EB70DB94CA54
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697511EB Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • TlsGetValue.KERNEL32 ref: 697511FD
                                                                                                                              • TlsGetValue.KERNEL32 ref: 69751214
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,69758118,6975808E,00000014,697549D9,00000000,00000FA0,6975B5E8,0000000C,69754A3F,69747D8D,00066BCC,?,6975186F,00000004), ref: 69751229
                                                                                                                              • GetProcAddress.KERNEL32(00000000,EncodePointer,?,69758118,6975808E,00000014,697549D9,00000000,00000FA0,6975B5E8,0000000C,69754A3F,69747D8D,00066BCC,?,6975186F), ref: 69751239
                                                                                                                              • RtlEncodePointer.NTDLL(69747D8D,?,69758118,6975808E,00000014,697549D9,00000000,00000FA0,6975B5E8,0000000C,69754A3F,69747D8D,00066BCC,?,6975186F,00000004), ref: 69751246
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$AddressEncodeHandleModulePointerProc
                                                                                                                              • String ID: EncodePointer$KERNEL32.DLL
                                                                                                                              • API String ID: 3030820695-3682587211
                                                                                                                              • Opcode ID: 595ecd4896578817ee566c643b079b215afef85fd68c4b45b7bedf00fa743d35
                                                                                                                              • Instruction ID: a63bf67eb2a4204c2560b33eed3c04fd8b9ef7fa064c751736ddf128226d8dcd
                                                                                                                              • Opcode Fuzzy Hash: 595ecd4896578817ee566c643b079b215afef85fd68c4b45b7bedf00fa743d35
                                                                                                                              • Instruction Fuzzy Hash: 09F0303074018AEB9FC0AF65DE449E93FE8FB416967014172F839D7161DF31D961DA60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69751264 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • TlsGetValue.KERNEL32 ref: 69751276
                                                                                                                              • TlsGetValue.KERNEL32 ref: 6975128D
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,697541C6,?,6975418C,69747D8D,?,?,6974FCAF,69747D8D,?,?,6974770E,00066BDC), ref: 697512A2
                                                                                                                              • GetProcAddress.KERNEL32(00000000,DecodePointer,?,697541C6,?,6975418C,69747D8D,?,?,6974FCAF,69747D8D,?,?,6974770E,00066BDC), ref: 697512B2
                                                                                                                              • RtlDecodePointer.NTDLL(69747D8D,?,697541C6,?,6975418C,69747D8D,?,?,6974FCAF,69747D8D,?,?,6974770E,00066BDC), ref: 697512BF
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$AddressDecodeHandleModulePointerProc
                                                                                                                              • String ID: DecodePointer$KERNEL32.DLL
                                                                                                                              • API String ID: 3637547452-629428536
                                                                                                                              • Opcode ID: a606ed21f96eb465458e02fbee7543bd3241d2ddfab9227bd75377fdd6e2ed42
                                                                                                                              • Instruction ID: ca2667492a1ebe5e7b446e9430c1ba5a5a9aefd170c2f84e6a2412547ff4fb4a
                                                                                                                              • Opcode Fuzzy Hash: a606ed21f96eb465458e02fbee7543bd3241d2ddfab9227bd75377fdd6e2ed42
                                                                                                                              • Instruction Fuzzy Hash: 3EF0363474014AEBDFC06F69CE44DB93BD8FB416697104132F829D7161DF30D961EA60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A88CA4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • TlsGetValue.KERNEL32 ref: 00A88CB6
                                                                                                                              • TlsGetValue.KERNEL32 ref: 00A88CCD
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00A88D16,00000000,00A8E017,00000314,00A99768,00000000,?,?,?,?,00A88325,00A99768,Microsoft Visual C++ Runtime Library,00012010), ref: 00A88CE2
                                                                                                                              • GetProcAddress.KERNEL32(00000000,EncodePointer,?,00A88D16,00000000,00A8E017,00000314,00A99768,00000000,?,?,?,?,00A88325,00A99768,Microsoft Visual C++ Runtime Library), ref: 00A88CF2
                                                                                                                              • RtlEncodePointer.NTDLL(00A99768,?,00A88D16,00000000,00A8E017,00000314,00A99768,00000000,?,?,?,?,00A88325,00A99768,Microsoft Visual C++ Runtime Library,00012010), ref: 00A88CFF
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$AddressEncodeHandleModulePointerProc
                                                                                                                              • String ID: EncodePointer$KERNEL32.DLL
                                                                                                                              • API String ID: 3030820695-3682587211
                                                                                                                              • Opcode ID: 789415934882250d452a7e6559f5be3b9facdfef05761016269c345b80f285b8
                                                                                                                              • Instruction ID: a3a9e6133bfa6c3523d7afbec41f50d77e7bde8ef990b44fd2573bd88de72bf1
                                                                                                                              • Opcode Fuzzy Hash: 789415934882250d452a7e6559f5be3b9facdfef05761016269c345b80f285b8
                                                                                                                              • Instruction Fuzzy Hash: 03F05E70A40206ABCB10BBA6DC08EAA3FADEB413A47544121F928D61A5DF39DC53CB60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A88D1D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • TlsGetValue.KERNEL32 ref: 00A88D2F
                                                                                                                              • TlsGetValue.KERNEL32 ref: 00A88D46
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00A88DB1,?,00A8988D,?,?,?,00000000), ref: 00A88D5B
                                                                                                                              • GetProcAddress.KERNEL32(00000000,DecodePointer,?,00A88DB1,?,00A8988D,?,?,?,00000000), ref: 00A88D6B
                                                                                                                              • RtlDecodePointer.NTDLL(?,?,00A88DB1,?,00A8988D,?,?,?,00000000), ref: 00A88D78
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$AddressDecodeHandleModulePointerProc
                                                                                                                              • String ID: DecodePointer$KERNEL32.DLL
                                                                                                                              • API String ID: 3637547452-629428536
                                                                                                                              • Opcode ID: d25116fa879db19db8aa67fb59bce860d74a13f38020f6e9f41f7d4219947741
                                                                                                                              • Instruction ID: b3b793f8c44857a6e31e23d0d17a62e45d118716122923f76a6f3f71e58c5dda
                                                                                                                              • Opcode Fuzzy Hash: d25116fa879db19db8aa67fb59bce860d74a13f38020f6e9f41f7d4219947741
                                                                                                                              • Instruction Fuzzy Hash: 9AF0D030640606ABCB10BBB5ED44EA63BA8AF527907544622F918D61F0DF35DD53CB60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C097A14 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • TlsGetValue.KERNEL32 ref: 6C097A26
                                                                                                                              • TlsGetValue.KERNEL32 ref: 6C097A3D
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,6C097A86,00000000,6C0A03F0,00000314,6C0A59B8,00000000,?,?,?,?,6C09CB75,6C0A59B8,Microsoft Visual C++ Runtime Library,00012010), ref: 6C097A52
                                                                                                                              • GetProcAddress.KERNEL32(00000000,EncodePointer,?,6C097A86,00000000,6C0A03F0,00000314,6C0A59B8,00000000,?,?,?,?,6C09CB75,6C0A59B8,Microsoft Visual C++ Runtime Library), ref: 6C097A62
                                                                                                                              • RtlEncodePointer.NTDLL(6C0A59B8,?,6C097A86,00000000,6C0A03F0,00000314,6C0A59B8,00000000,?,?,?,?,6C09CB75,6C0A59B8,Microsoft Visual C++ Runtime Library,00012010), ref: 6C097A6F
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$AddressEncodeHandleModulePointerProc
                                                                                                                              • String ID: EncodePointer$KERNEL32.DLL
                                                                                                                              • API String ID: 3030820695-3682587211
                                                                                                                              • Opcode ID: 418ed882431285f7bd1f6b771c1649d14260e8fceca7e1b16ed78ab509fe81f1
                                                                                                                              • Instruction ID: 32300d15279e481703893ed6e98431e4b0b46176262e9aa456bc2f91d7d58b39
                                                                                                                              • Opcode Fuzzy Hash: 418ed882431285f7bd1f6b771c1649d14260e8fceca7e1b16ed78ab509fe81f1
                                                                                                                              • Instruction Fuzzy Hash: A7F03031701105EBDF009FB9EC04FAD7BFCBB822A47116121B838D65A1DF31DA41BAA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C097A8D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • TlsGetValue.KERNEL32 ref: 6C097A9F
                                                                                                                              • TlsGetValue.KERNEL32 ref: 6C097AB6
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,6C097B21), ref: 6C097ACB
                                                                                                                              • GetProcAddress.KERNEL32(00000000,DecodePointer,?,6C097B21), ref: 6C097ADB
                                                                                                                              • RtlDecodePointer.NTDLL(?,?,6C097B21), ref: 6C097AE8
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$AddressDecodeHandleModulePointerProc
                                                                                                                              • String ID: DecodePointer$KERNEL32.DLL
                                                                                                                              • API String ID: 3637547452-629428536
                                                                                                                              • Opcode ID: 6a8ec8f9b3fe70b3c28cd64d058c233112428a57df4642d86ea968f7aa69e36a
                                                                                                                              • Instruction ID: 93a352bd405b07ef2c4f3f2105c2ea8a08c71371232f363392c49bd7991a9bc1
                                                                                                                              • Opcode Fuzzy Hash: 6a8ec8f9b3fe70b3c28cd64d058c233112428a57df4642d86ea968f7aa69e36a
                                                                                                                              • Instruction Fuzzy Hash: FEF03035301105FF9F019FA9ED44F9A7BF8BF812947156021B828D6590DF31DA01BAA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974F855 Relevance: 12.1, APIs: 8, Instructions: 112COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fileno
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1873356214-0
                                                                                                                              • Opcode ID: ef5b683614d1b8e23e59326d4fa24f2dae540675d4b2579da72ca2457d7a619c
                                                                                                                              • Instruction ID: de9c58124196cd8053d8e9d532eef325bb69fda35167dabb1eccc930acaae445
                                                                                                                              • Opcode Fuzzy Hash: ef5b683614d1b8e23e59326d4fa24f2dae540675d4b2579da72ca2457d7a619c
                                                                                                                              • Instruction Fuzzy Hash: EF315D72800504ABC741DF348F8669D37A45F02378F11A678E426DF0E2EF38D652A659
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A87285 Relevance: 12.1, APIs: 8, Instructions: 112COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fileno
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1873356214-0
                                                                                                                              • Opcode ID: 7986ccdf4c8ce391125ff256dfa66171ec798d19231c6987551b7d2576523a0e
                                                                                                                              • Instruction ID: 8989d0a985d06f6aa48c434091414e6737a6916069e6d8d471b8b346ce4369b3
                                                                                                                              • Opcode Fuzzy Hash: 7986ccdf4c8ce391125ff256dfa66171ec798d19231c6987551b7d2576523a0e
                                                                                                                              • Instruction Fuzzy Hash: CB315F325085145BE715BF748E86E9D37A0DF12334F344626F425EE0D2EB38CA51A797
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0971BC Relevance: 12.1, APIs: 8, Instructions: 112COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fileno
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1873356214-0
                                                                                                                              • Opcode ID: 4faa5ae68251926da7a8b4b3a3202d27118aa30d331f8a149412cc66a4a288a1
                                                                                                                              • Instruction ID: 3d86853a2f21b5a24782fd3c76212beb10742b696c9cbd6e22697e3a6ec95e6d
                                                                                                                              • Opcode Fuzzy Hash: 4faa5ae68251926da7a8b4b3a3202d27118aa30d331f8a149412cc66a4a288a1
                                                                                                                              • Instruction Fuzzy Hash: 913124329196199AD7105BBC8C40BDD37F0AF0233CF247614F52CDBAD1DF38A689AA55
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69751957 Relevance: 10.7, APIs: 7, Instructions: 184COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetStartupInfoA.KERNEL32 ref: 6975196C
                                                                                                                                • Part of subcall function 69751911: __calloc_impl.LIBCMT ref: 69751926
                                                                                                                              • GetFileType.KERNEL32 ref: 69751A7A
                                                                                                                              • ___crtInitCritSecAndSpinCount.LIBCMT ref: 69751AAE
                                                                                                                              • GetStdHandle.KERNEL32(-000000F6), ref: 69751B05
                                                                                                                              • GetFileType.KERNEL32 ref: 69751B17
                                                                                                                              • ___crtInitCritSecAndSpinCount.LIBCMT ref: 69751B45
                                                                                                                              • SetHandleCount.KERNEL32 ref: 69751B70
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Count$CritFileHandleInitSpinType___crt$InfoStartup__calloc_impl
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3691444693-0
                                                                                                                              • Opcode ID: 5ed39c8852e637866f396452bb3d05dc252636af7d032e4010f42befa6a98b76
                                                                                                                              • Instruction ID: ef248a700cbb33f28d56a45db81e93916ea4a987892c61b49c6d934df989c1c7
                                                                                                                              • Opcode Fuzzy Hash: 5ed39c8852e637866f396452bb3d05dc252636af7d032e4010f42befa6a98b76
                                                                                                                              • Instruction Fuzzy Hash: 60615531A443818FDB91CF28CA897197BE0BF0272AF298679D4639B2D1EF30D452CB11
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C098180 Relevance: 10.7, APIs: 7, Instructions: 184COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetStartupInfoA.KERNEL32 ref: 6C098195
                                                                                                                                • Part of subcall function 6C09813A: __calloc_impl.LIBCMT ref: 6C09814F
                                                                                                                              • GetFileType.KERNEL32 ref: 6C0982A3
                                                                                                                              • ___crtInitCritSecAndSpinCount.LIBCMT ref: 6C0982D7
                                                                                                                              • GetStdHandle.KERNEL32(-000000F6), ref: 6C09832E
                                                                                                                              • GetFileType.KERNEL32 ref: 6C098340
                                                                                                                              • ___crtInitCritSecAndSpinCount.LIBCMT ref: 6C09836E
                                                                                                                              • SetHandleCount.KERNEL32 ref: 6C098399
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Count$CritFileHandleInitSpinType___crt$InfoStartup__calloc_impl
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3691444693-0
                                                                                                                              • Opcode ID: 738ee745e3156f519eed4bd4a69ba657150ffde097ef120f8fff99f490c1d077
                                                                                                                              • Instruction ID: 3603ab699301de25a1fbce93245da4bc5b8cdb67dd869bcfd3261a8d1ee42169
                                                                                                                              • Opcode Fuzzy Hash: 738ee745e3156f519eed4bd4a69ba657150ffde097ef120f8fff99f490c1d077
                                                                                                                              • Instruction Fuzzy Hash: 12611571608B418FDB10CB68C848B197BF0AF06728F28A75AD576DBBD2DB30D405E711
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697491C4 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 157COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(?,?,?,00000104,?,?,00000104,?), ref: 6974934B
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast
                                                                                                                              • String ID: CSetup::InstallPlugIn$DirectXUpdateInstallPlugIn() failed.$GetCDXUpdate() failed.$Temporary directory name is not initialized.$Working directory name is not initialized.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\dxupdate.cpp
                                                                                                                              • API String ID: 1452528299-1736279303
                                                                                                                              • Opcode ID: bf80f78e2b1184bfc3c3dbd8541c87c02b8c2d033d6420898cb0b4baf03049b5
                                                                                                                              • Instruction ID: bfa48fe1f83fc2344947bbef7f29cb21d459951f1f78fe79daf2b45d5d5a1891
                                                                                                                              • Opcode Fuzzy Hash: bf80f78e2b1184bfc3c3dbd8541c87c02b8c2d033d6420898cb0b4baf03049b5
                                                                                                                              • Instruction Fuzzy Hash: FE51D8B694021DAFDB10DF648F88ADEB7B8BB25F08F0045A9E555E6143DB705F908F50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697472FC Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadStringA.USER32 ref: 6974736D
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 69747378
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$ErrorLastLoadString_strrchr
                                                                                                                              • String ID: DXSetRestorePoint$LoadString()$e$e:\bt\382730\setup\deliverables\dsetup\dsetup32\instcat.cpp
                                                                                                                              • API String ID: 2420349584-3812728853
                                                                                                                              • Opcode ID: a502d3da56aa9607363b19904e6c0152ad30e8cd80ddf534f436ab3a1a3ac1d1
                                                                                                                              • Instruction ID: 02be35463da8c4e74b7a0e650a233ba80e64b4e817785cb3cf1d27413c8f3f66
                                                                                                                              • Opcode Fuzzy Hash: a502d3da56aa9607363b19904e6c0152ad30e8cd80ddf534f436ab3a1a3ac1d1
                                                                                                                              • Instruction Fuzzy Hash: 67219670A00299EBDF90DFA58B0497D7BB8EF05F84F40413AEC15D6142EB709715CB51
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69748850 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 32libraryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadLibraryA.KERNEL32(?), ref: 6974886C
                                                                                                                              • GetLastError.KERNEL32(Unable to load %s.,?), ref: 69748881
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              • CDllLoader::LoadLibraryA, xrefs: 6974888D
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 69748897
                                                                                                                              • Unable to load %s., xrefs: 6974887C
                                                                                                                              • LoadLibrary(), xrefs: 69748888
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$ErrorLastLibraryLoad_strrchr
                                                                                                                              • String ID: CDllLoader::LoadLibraryA$LoadLibrary()$Unable to load %s.$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 108046663-2531695590
                                                                                                                              • Opcode ID: c1027dafbcae6a3e0da70229a3829627d8198500669f89babfdd5a44f6cc5df7
                                                                                                                              • Instruction ID: b9aecc1d9d16d9ab892a5245b8c1cce92be5c2e8c18aefa05a39e4d77285f748
                                                                                                                              • Opcode Fuzzy Hash: c1027dafbcae6a3e0da70229a3829627d8198500669f89babfdd5a44f6cc5df7
                                                                                                                              • Instruction Fuzzy Hash: 8CF0E536550208BFDB117FA0CE08CDA3E5CDB62F907404032F944DA002F670A6718AA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697524A1 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __locking$__fileno__lseeki64
                                                                                                                              • String ID: Fcti
                                                                                                                              • API String ID: 3501863086-2862073994
                                                                                                                              • Opcode ID: df0627931646415c5a84ed5d7e72a3f585b1c4694c6b62edc6dec843b856240d
                                                                                                                              • Instruction ID: 5977cf433717457ab4df9c7a3dea9859cd679182aa08e1de790c677e94ba7130
                                                                                                                              • Opcode Fuzzy Hash: df0627931646415c5a84ed5d7e72a3f585b1c4694c6b62edc6dec843b856240d
                                                                                                                              • Instruction Fuzzy Hash: BB41E8B15046049FD7A08F29CA51A5A7BE4BF45374B10C66DE8BBCB2E0DF34D9628B10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697485E5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FreeLibrary.KERNELBASE(00000000,00000000,6974919D,?,?,?,?,?,?,?), ref: 697485F1
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 697485FB
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 69748617
                                                                                                                              • FreeLibrary(), xrefs: 69748608
                                                                                                                              • CDllLoader::FreeLibrary, xrefs: 6974860D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$ErrorFreeLastLibrary_strrchr
                                                                                                                              • String ID: CDllLoader::FreeLibrary$FreeLibrary()$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 2808663981-1330908120
                                                                                                                              • Opcode ID: ef1ad73d7170d4665c8009eee60684320a5901dcbc92aac43fb804812d57cb74
                                                                                                                              • Instruction ID: 9cafad7f5668b43d99ee94a644d2f470baf905dd288461de2324c76986977303
                                                                                                                              • Opcode Fuzzy Hash: ef1ad73d7170d4665c8009eee60684320a5901dcbc92aac43fb804812d57cb74
                                                                                                                              • Instruction Fuzzy Hash: AEE0D8317041549BFB903A69AF08BE622CCDB50E15F4104B57844D5043FA30C6114592
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69746B07 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 21COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FreeLibrary.KERNELBASE(00000000,697473FF), ref: 69746B11
                                                                                                                              • GetLastError.KERNEL32 ref: 69746B1B
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              • UnLoadSfcDLL, xrefs: 69746B2D
                                                                                                                              • FreeLibrary(), xrefs: 69746B28
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\instcat.cpp, xrefs: 69746B34
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$ErrorFreeLastLibrary_strrchr
                                                                                                                              • String ID: FreeLibrary()$UnLoadSfcDLL$e:\bt\382730\setup\deliverables\dsetup\dsetup32\instcat.cpp
                                                                                                                              • API String ID: 2808663981-3437185699
                                                                                                                              • Opcode ID: 41096acb937835a38be5415147bd38ecd3526c524d9b2ffee05ee35dc226f061
                                                                                                                              • Instruction ID: 1844006c9de677a10679830d7481f72c4339d062aceb0d781e8965963f89d30c
                                                                                                                              • Opcode Fuzzy Hash: 41096acb937835a38be5415147bd38ecd3526c524d9b2ffee05ee35dc226f061
                                                                                                                              • Instruction Fuzzy Hash: 15E0EC34780645ABEB907E61CE09BB5315CBB62F85FD04074A405E1083FB259720C911
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8961B Relevance: 6.1, APIs: 4, Instructions: 124COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __locking$__fileno__lseeki64
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3501863086-0
                                                                                                                              • Opcode ID: babb7505fa50ea5ade9be8a995135f29e953899ebc0282c4591e79ab7dc8dd48
                                                                                                                              • Instruction ID: c5660584034d4c5e6e3f56238c493e6f715d9c54925817e928b64c4d0b6fdcdc
                                                                                                                              • Opcode Fuzzy Hash: babb7505fa50ea5ade9be8a995135f29e953899ebc0282c4591e79ab7dc8dd48
                                                                                                                              • Instruction Fuzzy Hash: 0741C271510A009FDB24BF69C985A777BE4AF45334B28C639F8BACB6E1E734D8408B50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C098CC1 Relevance: 6.1, APIs: 4, Instructions: 124COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __locking$__fileno__lseeki64
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3501863086-0
                                                                                                                              • Opcode ID: 1d47630dfeffd7d2e3c7c2a2a6dd9469082fbb18a5c3bf91e116ee9a1eaa5e7d
                                                                                                                              • Instruction ID: c0248332b442460a646105a16b442283fd103e3f7d0475e0506b2830ad591ee6
                                                                                                                              • Opcode Fuzzy Hash: 1d47630dfeffd7d2e3c7c2a2a6dd9469082fbb18a5c3bf91e116ee9a1eaa5e7d
                                                                                                                              • Instruction Fuzzy Hash: 3041C772106A045FCB208F69D841B567BE4AF52338F24E71EE4BA8BFE1D774E8409B50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6975093C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __fileno.LIBCMT ref: 697509E4
                                                                                                                              • __locking.LIBCMT ref: 697509EB
                                                                                                                                • Part of subcall function 6975364D: __fileno.LIBCMT ref: 6975367B
                                                                                                                                • Part of subcall function 6975364D: __locking.LIBCMT ref: 69753682
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fileno__locking
                                                                                                                              • String ID: Fcti
                                                                                                                              • API String ID: 2385650056-2862073994
                                                                                                                              • Opcode ID: 02e2f43521c7a4e35838aa8e8277f96aefa119708a2ac267273df05b4f0f5f54
                                                                                                                              • Instruction ID: f251941f6afcafbceeb617a687e3ce81da3210a13b87de9fbf892dd752d87a85
                                                                                                                              • Opcode Fuzzy Hash: 02e2f43521c7a4e35838aa8e8277f96aefa119708a2ac267273df05b4f0f5f54
                                                                                                                              • Instruction Fuzzy Hash: 2831E735A00708DFEB94CF69C685A9E77B5FF81368B20852DE85F87254EF70DA608B40
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6975364D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fileno__locking
                                                                                                                              • String ID: Fcti
                                                                                                                              • API String ID: 2385650056-2862073994
                                                                                                                              • Opcode ID: 50394860220720d4416018d745a5e50297c336960fa7dd4b146ab0390e6b35af
                                                                                                                              • Instruction ID: 2f91303bd613cd565552934f227ca60719ff50def628c096bc612f4a9758cdee
                                                                                                                              • Opcode Fuzzy Hash: 50394860220720d4416018d745a5e50297c336960fa7dd4b146ab0390e6b35af
                                                                                                                              • Instruction Fuzzy Hash: 4F01A272204B00DFE7558A6DCA85A53B7E9EF81374F10892DE4FA833A0DE64E8604A50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974871F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemDefaultLCID.KERNEL32(69748753,69748D1D,?,69748E5E,?,697492F0), ref: 6974871F
                                                                                                                              Strings
                                                                                                                              • DirectXSetupIsJapanese == 1, xrefs: 6974872C
                                                                                                                              • DirectXSetupIsJapanese == 0, xrefs: 6974873B
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DefaultSystem
                                                                                                                              • String ID: DirectXSetupIsJapanese == 0$DirectXSetupIsJapanese == 1
                                                                                                                              • API String ID: 511829978-1705903668
                                                                                                                              • Opcode ID: 2c4d8df3e625571f4620e3e60cfee0d686ca695dda06723f0b4e5a103e59a725
                                                                                                                              • Instruction ID: 7b582156743be144748a5d864675edb162a8590e1e51de148850ef8b4309f198
                                                                                                                              • Opcode Fuzzy Hash: 2c4d8df3e625571f4620e3e60cfee0d686ca695dda06723f0b4e5a103e59a725
                                                                                                                              • Instruction Fuzzy Hash: 86C08CB565C0602AAA45B2B09F498CC22018381F1A7604C73E203C0C53CF4082321011
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69753431 Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CloseHandle.KERNELBASE(00000000), ref: 69753480
                                                                                                                              • GetLastError.KERNEL32(?,6975904E,00000109), ref: 6975348A
                                                                                                                              • __dosmaperr.LIBCMT ref: 697534B9
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseErrorHandleLast__dosmaperr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2583163307-0
                                                                                                                              • Opcode ID: 686d0f16c8225ffe6848fa119b301e609776ef8764ca010a0e8165acac231e3a
                                                                                                                              • Instruction ID: 786f916e419ae6f53bf0d5301bb6a2bf43820b2433660e9c162107523429febc
                                                                                                                              • Opcode Fuzzy Hash: 686d0f16c8225ffe6848fa119b301e609776ef8764ca010a0e8165acac231e3a
                                                                                                                              • Instruction Fuzzy Hash: DC016B37528250A6DFC392799B0DBBA27988F82338F15453AEC2AD71F1CF30DC614195
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8A63E Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CloseHandle.KERNELBASE(00000000), ref: 00A8A68D
                                                                                                                              • GetLastError.KERNEL32(?,00A902BE,00000109), ref: 00A8A697
                                                                                                                              • __dosmaperr.LIBCMT ref: 00A8A6C6
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseErrorHandleLast__dosmaperr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2583163307-0
                                                                                                                              • Opcode ID: ca69f540b686ce9d3fd992743f0961222cec7ba03119b7e4f92eef1a114b24df
                                                                                                                              • Instruction ID: 50398ee3a891c9ec0dd4025c207d503ba6b0f8503a9a73a55b965381060c8348
                                                                                                                              • Opcode Fuzzy Hash: ca69f540b686ce9d3fd992743f0961222cec7ba03119b7e4f92eef1a114b24df
                                                                                                                              • Instruction Fuzzy Hash: 000149325002101AEA2473786E49B5A77988FA17F4F2D023BF818C71D6EF61DD8187A3
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09BDAB Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CloseHandle.KERNELBASE(00000000), ref: 6C09BDFA
                                                                                                                              • GetLastError.KERNEL32(?,6C09FAFD,00000109), ref: 6C09BE04
                                                                                                                              • __dosmaperr.LIBCMT ref: 6C09BE33
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseErrorHandleLast__dosmaperr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2583163307-0
                                                                                                                              • Opcode ID: 4e49a8c4a04985f7280b0fb6b52df319f5b3f81ef332079f4316357b2d8bdccd
                                                                                                                              • Instruction ID: 4519b50099d48c0898718c70182cd2c1b29ee48e0657457d8afffa720e5664e2
                                                                                                                              • Opcode Fuzzy Hash: 4e49a8c4a04985f7280b0fb6b52df319f5b3f81ef332079f4316357b2d8bdccd
                                                                                                                              • Instruction Fuzzy Hash: 15018E3361D12466CF20127E99057CA36FD8F8273CF292157FD25C7AD1DFA0E841A191
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69758251 Relevance: 4.6, APIs: 3, Instructions: 52COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetFilePointer.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00BFBBEF,697592B8,697592B8,?,69756AD7,00BFBBEF,00000000,00000000,00000002,00000000,00000000), ref: 69758293
                                                                                                                              • GetLastError.KERNEL32(?,69756AD7,00BFBBEF,00000000,00000000,00000002,00000000,00000000,00000002), ref: 697582A0
                                                                                                                              • __dosmaperr.LIBCMT ref: 697582AB
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastPointer__dosmaperr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2336955059-0
                                                                                                                              • Opcode ID: 43d766297c8e8839177a6b4cc805c41110e627a465945454a3796eba9518c216
                                                                                                                              • Instruction ID: 856f327332ca34ba538d2eff248a632a42ee7186a511854bef2260b088d7ed4f
                                                                                                                              • Opcode Fuzzy Hash: 43d766297c8e8839177a6b4cc805c41110e627a465945454a3796eba9518c216
                                                                                                                              • Instruction Fuzzy Hash: 6A018E36B20609AFCF40CF99DA448CE7FA9EB86320B254156E411E7290EE70EE10CB60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8ECF3 Relevance: 4.6, APIs: 3, Instructions: 52COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,?,00A8EF80,?,00000000,00000000,00000002,00000000,00000000), ref: 00A8ED35
                                                                                                                              • GetLastError.KERNEL32(?,00A8EF80,?,00000000,00000000,00000002,00000000,00000000,?), ref: 00A8ED42
                                                                                                                              • __dosmaperr.LIBCMT ref: 00A8ED4D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastPointer__dosmaperr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2336955059-0
                                                                                                                              • Opcode ID: 01af5a9ff03b9ec0fc623e3a15c2d752e2b1459e4aeeb028bffacea30b9c7715
                                                                                                                              • Instruction ID: 2e3d3eb9d09d69678f14ec7e51230c05b875eb2e2c2eba95e7e9f18c5460131d
                                                                                                                              • Opcode Fuzzy Hash: 01af5a9ff03b9ec0fc623e3a15c2d752e2b1459e4aeeb028bffacea30b9c7715
                                                                                                                              • Instruction Fuzzy Hash: 3301C432A10509EFCF00EFA9DC4488E7BB9EB44320B244256F510D7190E770EE418760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09DBF5 Relevance: 4.6, APIs: 3, Instructions: 52COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetFilePointer.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00BFBBEF,6C09FD67,6C09FD67,?,6C09DE82,00BFBBEF,00000000,00000000,00000002,00000000,00000000), ref: 6C09DC37
                                                                                                                              • GetLastError.KERNEL32(?,6C09DE82,00BFBBEF,00000000,00000000,00000002,00000000,00000000,00000002), ref: 6C09DC44
                                                                                                                              • __dosmaperr.LIBCMT ref: 6C09DC4F
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastPointer__dosmaperr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2336955059-0
                                                                                                                              • Opcode ID: b00fb72eb5ea7270df617ee11dd6ac0e3410764d7515ac1be3241390cf72e3de
                                                                                                                              • Instruction ID: 547a93d7871cf995a7514c4cb04478adafdb852b5cab827699d71f08c0b0a726
                                                                                                                              • Opcode Fuzzy Hash: b00fb72eb5ea7270df617ee11dd6ac0e3410764d7515ac1be3241390cf72e3de
                                                                                                                              • Instruction Fuzzy Hash: A101C4B6B14209AFCF00CFA9DD44B8D7BF9EB85324F245246F520D7280EBB0E9409B60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6975ADA2 Relevance: 4.5, APIs: 3, Instructions: 45COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetFilePointer.KERNELBASE(00000000,00000109,00000000,69759293,00004000,00000109,?,69759293,00000109,00000000,00000000), ref: 6975ADD1
                                                                                                                              • GetLastError.KERNEL32(?,69759293,00000109,00000000,00000000), ref: 6975ADDE
                                                                                                                              • __dosmaperr.LIBCMT ref: 6975ADED
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastPointer__dosmaperr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2336955059-0
                                                                                                                              • Opcode ID: 1568fdbbdaad67f6a41a094c319625122ba16e0bf134ebd0ba30658baced86d5
                                                                                                                              • Instruction ID: 3e0ffecbc8d61291efe4dd833d49255168d8333e5becbd04ceeb6622d4471bcf
                                                                                                                              • Opcode Fuzzy Hash: 1568fdbbdaad67f6a41a094c319625122ba16e0bf134ebd0ba30658baced86d5
                                                                                                                              • Instruction Fuzzy Hash: 6E01F432614665ABCA956BBD9E0898A3A58AF43775B214732F932CB1E0DF30D82042B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0A1C38 Relevance: 4.5, APIs: 3, Instructions: 45COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetFilePointer.KERNELBASE(00000000,00000109,00000000,6C09FD42,00004000,00000109,?,6C09FD42,00000109,00000000,00000000), ref: 6C0A1C67
                                                                                                                              • GetLastError.KERNEL32(?,6C09FD42,00000109,00000000,00000000), ref: 6C0A1C74
                                                                                                                              • __dosmaperr.LIBCMT ref: 6C0A1C83
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastPointer__dosmaperr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2336955059-0
                                                                                                                              • Opcode ID: 315375e2307003592a71ff0e18838f95c351e03f2e48a2935569e55aaf073563
                                                                                                                              • Instruction ID: f9c2f05abdbf9c03b5caa68c557c14c1552f2cc531af3b5b6c0187a7bcb389e8
                                                                                                                              • Opcode Fuzzy Hash: 315375e2307003592a71ff0e18838f95c351e03f2e48a2935569e55aaf073563
                                                                                                                              • Instruction Fuzzy Hash: 6201D132614519BACA010BFDDC04B893BF9AB83774F251352F934EB6D1CF70E8014660
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69748B45 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 69748B81
                                                                                                                              Strings
                                                                                                                              • Installing on Windows %d.%d.%d, xrefs: 69748BC5
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Version
                                                                                                                              • String ID: Installing on Windows %d.%d.%d
                                                                                                                              • API String ID: 1889659487-1252410366
                                                                                                                              • Opcode ID: e59eb58e89366d3514af5fd205e2929822420566f87fda13c4f55d87a0e4df43
                                                                                                                              • Instruction ID: 891bc1f40d6333035894330bb212519f9a0811d5634deeaca3dc64d8faa5d572
                                                                                                                              • Opcode Fuzzy Hash: e59eb58e89366d3514af5fd205e2929822420566f87fda13c4f55d87a0e4df43
                                                                                                                              • Instruction Fuzzy Hash: C201B9B1A01128DFCB919B788E05BDDB7B4AB06B14F4145A5D51DE2143EB308A55CF80
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8ACD6 Relevance: 3.1, APIs: 2, Instructions: 111COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __fileno.LIBCMT ref: 00A8AD7E
                                                                                                                              • __locking.LIBCMT ref: 00A8AD85
                                                                                                                                • Part of subcall function 00A8A85A: __fileno.LIBCMT ref: 00A8A888
                                                                                                                                • Part of subcall function 00A8A85A: __locking.LIBCMT ref: 00A8A88F
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fileno__locking
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2385650056-0
                                                                                                                              • Opcode ID: bfb6afbecca2cc93d3e23940c0fe19f15d0ba34b2ec945ddc6f7ff201cc985e2
                                                                                                                              • Instruction ID: 4fa09bfe67f37d06855f6cb54c578d46395c2c6878e75e5e93541ca396eaf0ef
                                                                                                                              • Opcode Fuzzy Hash: bfb6afbecca2cc93d3e23940c0fe19f15d0ba34b2ec945ddc6f7ff201cc985e2
                                                                                                                              • Instruction Fuzzy Hash: 4031A731600B04AFEF24EF69C584B9E7BB5EFA0361B24852EE855C7950D770ED41CB52
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09C3E5 Relevance: 3.1, APIs: 2, Instructions: 111COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __fileno.LIBCMT ref: 6C09C48D
                                                                                                                              • __locking.LIBCMT ref: 6C09C494
                                                                                                                                • Part of subcall function 6C09BFC7: __fileno.LIBCMT ref: 6C09BFF5
                                                                                                                                • Part of subcall function 6C09BFC7: __locking.LIBCMT ref: 6C09BFFC
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fileno__locking
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2385650056-0
                                                                                                                              • Opcode ID: 16a9ec58f811e1472a81cfb106c98d50de9a502f0f79c04f642017c80660e77a
                                                                                                                              • Instruction ID: ba66808973933414154d430ada570fc9b6d9426762e9b0cd09a9d292bc3ebf5a
                                                                                                                              • Opcode Fuzzy Hash: 16a9ec58f811e1472a81cfb106c98d50de9a502f0f79c04f642017c80660e77a
                                                                                                                              • Instruction Fuzzy Hash: BF31E571B01704AFDB24DFA9C480BAE7BF5EF85364F24A12DE859C7A40D770EA40AB40
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697540D3 Relevance: 3.1, APIs: 2, Instructions: 77memoryCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __FF_MSGBANNER.LIBCMT ref: 697540F6
                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,69747D7E,00066BDB,00066BDC,?,?,6974FCAF,69747D8D,?,?,6974770E,00066BDC,?,?,00000000), ref: 6975414A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocateHeap
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1279760036-0
                                                                                                                              • Opcode ID: a2c555246e0746543ec112624a72f34ac36826ab06561711ef25e7dbf1a3d10b
                                                                                                                              • Instruction ID: 67ffb56742099634d3d31f96f1eb5d623809c9f1851401fe57c48d28015111fa
                                                                                                                              • Opcode Fuzzy Hash: a2c555246e0746543ec112624a72f34ac36826ab06561711ef25e7dbf1a3d10b
                                                                                                                              • Instruction Fuzzy Hash: 26112931A4D215EAE6D1DB659F0071E2768EF223A4F115132E807DB190DF608C7166D1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8B45F Relevance: 3.1, APIs: 2, Instructions: 77memoryCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __FF_MSGBANNER.LIBCMT ref: 00A8B482
                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,?,?,00A8DAE6,00000018,00A96328,0000000C,00A8DB7C,?,?,?,00A8E36B,00000004), ref: 00A8B4D6
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocateHeap
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1279760036-0
                                                                                                                              • Opcode ID: 3d9700fca4577bef4c3d79f3bdba5a6cde53f175573ec29cd0191ba0a9133969
                                                                                                                              • Instruction ID: 61b8c8c690f4420a682f941f6787c688c0dadaef06b7665b4c6bf448336fe918
                                                                                                                              • Opcode Fuzzy Hash: 3d9700fca4577bef4c3d79f3bdba5a6cde53f175573ec29cd0191ba0a9133969
                                                                                                                              • Instruction Fuzzy Hash: EE113832A35220ABEB247B68AD4376E3758DF10730F204122FC0A9B1E2CF61DC8187B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974FB39 Relevance: 3.1, APIs: 2, Instructions: 67COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CallFilterFunc@8__getstream
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2779671989-0
                                                                                                                              • Opcode ID: ab59cfbee1fffa5185f8140aff7de1c7de36957cb124b9f5a9d3b08cb810211c
                                                                                                                              • Instruction ID: d4cf8e1c68ba125b66cc6fce4a500c5f0af4a43f5be13c7dbde6defdf7db8f98
                                                                                                                              • Opcode Fuzzy Hash: ab59cfbee1fffa5185f8140aff7de1c7de36957cb124b9f5a9d3b08cb810211c
                                                                                                                              • Instruction Fuzzy Hash: D7112FB4D0020ADFE780EFB88F8055E3AA4AF02708B15C839C012D7192EF388961E762
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A87569 Relevance: 3.1, APIs: 2, Instructions: 67COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CallFilterFunc@8__getstream
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2779671989-0
                                                                                                                              • Opcode ID: 0670f1a84f9b6b77d4adcf3f935e2705e8236217571a27c700d25bed9993c1a4
                                                                                                                              • Instruction ID: 5cc9a910aa91a1e07dccf0bbcf864c701aa2c77bf329afdd875511dc93060fbc
                                                                                                                              • Opcode Fuzzy Hash: 0670f1a84f9b6b77d4adcf3f935e2705e8236217571a27c700d25bed9993c1a4
                                                                                                                              • Instruction Fuzzy Hash: 6211C4B0D0C205AEEF107FB48D827AE77B5AF15310F718939E02997181E775CD9497A2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0974A0 Relevance: 3.1, APIs: 2, Instructions: 67COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CallFilterFunc@8__getstream
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2779671989-0
                                                                                                                              • Opcode ID: 6012b5ea511ad3b128b3f2a3384e18a4017f964f5f27964e1639ec47c3bdc7d8
                                                                                                                              • Instruction ID: 2ca126b835eda74b19b6ce1dccd05d5e871de689a1d12706c0fc2cccb949b192
                                                                                                                              • Opcode Fuzzy Hash: 6012b5ea511ad3b128b3f2a3384e18a4017f964f5f27964e1639ec47c3bdc7d8
                                                                                                                              • Instruction Fuzzy Hash: ED1127F2D042059FE750AFB98C813DE7AF0AF01314F59A978C41997B81EB74A948B761
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8A85A Relevance: 3.0, APIs: 2, Instructions: 47COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fileno__locking
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2385650056-0
                                                                                                                              • Opcode ID: ee1898c83c73028738548f1b3af915521830ca43611031c30255603978cbfc18
                                                                                                                              • Instruction ID: 898bb066c59cc88562154fb5b236e4879b79b48eccfee00cdd4f14e8dcd7a7e1
                                                                                                                              • Opcode Fuzzy Hash: ee1898c83c73028738548f1b3af915521830ca43611031c30255603978cbfc18
                                                                                                                              • Instruction Fuzzy Hash: 4F018B33600B015FF7216A6DC895A53B7E8EF95370F10851EE4A5C7681D674EC424B61
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09BFC7 Relevance: 3.0, APIs: 2, Instructions: 47COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fileno__locking
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2385650056-0
                                                                                                                              • Opcode ID: 46460d34f8ef143c1d95679b96208fb330207c26e11226a4fe7a61c09fa8abde
                                                                                                                              • Instruction ID: c37bc1eca87f644348e8be214d20bbde6ed74d0065fe495c702c3d548c553b82
                                                                                                                              • Opcode Fuzzy Hash: 46460d34f8ef143c1d95679b96208fb330207c26e11226a4fe7a61c09fa8abde
                                                                                                                              • Instruction Fuzzy Hash: 1401DB32608B005FD7209A6DC845B57F7E9DF813F4F14961DE4B983A80D775F8446B90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69752139 Relevance: 3.0, APIs: 2, Instructions: 33memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • HeapCreate.KERNELBASE(00000000,00001000,00000000,?,6974F2E7,00000001), ref: 6975214E
                                                                                                                              • HeapDestroy.KERNEL32(?,6974F2E7,00000001), ref: 69752185
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Heap$CreateDestroy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3296620671-0
                                                                                                                              • Opcode ID: 5047a77b9865548e59d2985551d5ffa8647678bd7972ff5470d021834e98bb11
                                                                                                                              • Instruction ID: c1ec2599f8eb0c10fab562e2b7536da781c040105b90de36c070ef7966612c05
                                                                                                                              • Opcode Fuzzy Hash: 5047a77b9865548e59d2985551d5ffa8647678bd7972ff5470d021834e98bb11
                                                                                                                              • Instruction Fuzzy Hash: 5FF03071659384EEEFC1AB709B4AB3A3AACDB81799F105436E50EC5044EF7480719602
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A89296 Relevance: 3.0, APIs: 2, Instructions: 33memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00A892AB
                                                                                                                              • HeapDestroy.KERNEL32 ref: 00A892E2
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Heap$CreateDestroy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3296620671-0
                                                                                                                              • Opcode ID: 35f5c658fcd6463e6d1d3e9f0810dd25341019d41db0159cf71294bfcd04b6a0
                                                                                                                              • Instruction ID: 0648afef15fabf369cb1c059748054d518fb8bdaa061605678063eb1515479ae
                                                                                                                              • Opcode Fuzzy Hash: 35f5c658fcd6463e6d1d3e9f0810dd25341019d41db0159cf71294bfcd04b6a0
                                                                                                                              • Instruction Fuzzy Hash: 55F0A931764301BAEF11FBB5BC8A7B736D8EB443A9F24842AF40CC44A1FE7584928B00
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C098962 Relevance: 3.0, APIs: 2, Instructions: 33memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • HeapCreate.KERNELBASE(00000000,00001000,00000000,?,6C096840,00000001), ref: 6C098977
                                                                                                                              • HeapDestroy.KERNEL32(?,6C096840,00000001), ref: 6C0989AE
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Heap$CreateDestroy
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3296620671-0
                                                                                                                              • Opcode ID: 755fd9c35aaa525620a4f9b55ab4f318c6981fa5890c9e4a48cf7291ec708326
                                                                                                                              • Instruction ID: 28396b25d8486212903a7e1c3ff0913ddf01525fe5926ea27256d4345e75cb9f
                                                                                                                              • Opcode Fuzzy Hash: 755fd9c35aaa525620a4f9b55ab4f318c6981fa5890c9e4a48cf7291ec708326
                                                                                                                              • Instruction Fuzzy Hash: 48F0A732748705AEEB005FF2AC08B5D36F8E742349F185526E409C5682EF708040AE01
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A87F24 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___crtCorExitProcess.LIBCMT ref: 00A87F2C
                                                                                                                                • Part of subcall function 00A87EF4: GetModuleHandleA.KERNEL32(mscoree.dll,?,00A87F31,?,?,00A8B498,000000FF,0000001E,?,00A8DAE6,00000018,00A96328,0000000C,00A8DB7C,?,?), ref: 00A87EFE
                                                                                                                                • Part of subcall function 00A87EF4: GetProcAddress.KERNEL32(00000000,CorExitProcess,?,00A87F31,?,?,00A8B498,000000FF,0000001E,?,00A8DAE6,00000018,00A96328,0000000C,00A8DB7C,?), ref: 00A87F0E
                                                                                                                              • ExitProcess.KERNEL32 ref: 00A87F35
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2427264223-0
                                                                                                                              • Opcode ID: e125412d2554430fe1ccfd82697a6ace51bf8eab9b126e27f1f761269e561e02
                                                                                                                              • Instruction ID: 6c5c8a6d0d07b898127ceb1c94524928c050b5aee5af0b4cd2053045925aac8b
                                                                                                                              • Opcode Fuzzy Hash: e125412d2554430fe1ccfd82697a6ace51bf8eab9b126e27f1f761269e561e02
                                                                                                                              • Instruction Fuzzy Hash: 14B09231004108BBCB013F56DC0E84E3F2AEB813A0B2441A4F90809831DF72ED93DB80
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697470AE Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 697470E9
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Version
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1889659487-0
                                                                                                                              • Opcode ID: 88f1bdcb157ae478cd226e5aa8d083b5496e6e145999a9256cf3a0d6b174fe56
                                                                                                                              • Instruction ID: 5c818167b7ff273fd6ff4cf0dc8b7cc58a6f877284ef0f7391a1ee1d6a079022
                                                                                                                              • Opcode Fuzzy Hash: 88f1bdcb157ae478cd226e5aa8d083b5496e6e145999a9256cf3a0d6b174fe56
                                                                                                                              • Instruction Fuzzy Hash: ED014034A04256CBEFA0DB748B4674973F4AB46B48F50817AD819D2183FF70CA898B11
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69747157 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 69747192
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Version
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1889659487-0
                                                                                                                              • Opcode ID: 583567a1dd0a840dfe4fd554dfae8579437429a07347e8f9ce79bd8084fc9823
                                                                                                                              • Instruction ID: 1144ebd130b0b155a2e128c5d18f448475df81f7f9c334129be8ed7f2ae1e10f
                                                                                                                              • Opcode Fuzzy Hash: 583567a1dd0a840dfe4fd554dfae8579437429a07347e8f9ce79bd8084fc9823
                                                                                                                              • Instruction Fuzzy Hash: 97014F30A00245CFDB90DB788B8675D77F4AB86B58F5140B9C82DD2183EF70D989DB11
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69751024 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __initterm_e
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4027532054-0
                                                                                                                              • Opcode ID: eb8b5b0ed3a77f6fec366b39ce166f2cc226f3cfd3d14919734ec21ac2257e09
                                                                                                                              • Instruction ID: 7126426e61294c2c3c815320af20d38790114c94ee7848b8057047f9969b70da
                                                                                                                              • Opcode Fuzzy Hash: eb8b5b0ed3a77f6fec366b39ce166f2cc226f3cfd3d14919734ec21ac2257e09
                                                                                                                              • Instruction Fuzzy Hash: 35F054353883456BEFE4BBA75B09B293658EB01B1BF64803DF81EE94C1DF60C1708195
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974F7D4 Relevance: 1.5, APIs: 1, Instructions: 39COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fclose_nolock
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4232755567-0
                                                                                                                              • Opcode ID: e683840448de06a64a81b279289209683300c0064540fe7d1a58d34adfdce0dc
                                                                                                                              • Instruction ID: bfa281f1b803322ee660b8889087e8660cc5c6431ab47a94d966a06f96bbc42d
                                                                                                                              • Opcode Fuzzy Hash: e683840448de06a64a81b279289209683300c0064540fe7d1a58d34adfdce0dc
                                                                                                                              • Instruction Fuzzy Hash: E6F0F675C00B08DAC751EB699F0469E7BE4AF41338F11D719D03A9A0D2CF385612AF5A
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A87204 Relevance: 1.5, APIs: 1, Instructions: 39COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fclose_nolock
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4232755567-0
                                                                                                                              • Opcode ID: 175028628867b8c9f17ca271a88025296dfdfee39bee4bc9ac6b35ac64d9e950
                                                                                                                              • Instruction ID: 97f5906347442e5d9981cc3bb48eaed0ab7bfcb8daee78e65f6f7cd6bc52c625
                                                                                                                              • Opcode Fuzzy Hash: 175028628867b8c9f17ca271a88025296dfdfee39bee4bc9ac6b35ac64d9e950
                                                                                                                              • Instruction Fuzzy Hash: 47F0F670C0860499DB10BB688A4669E7BF06F51330F70C346F03D960D2D77899429B46
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A87FEA Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __initterm_e
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4027532054-0
                                                                                                                              • Opcode ID: 397ee602f308cfa802d03c51f6814e9eaf4a2df8f9a6590397e591609da7e045
                                                                                                                              • Instruction ID: 1bf78f5f6ac4d40271b79f7e264fda43c0bfb9035d7aa7ea5656eec4bc22922a
                                                                                                                              • Opcode Fuzzy Hash: 397ee602f308cfa802d03c51f6814e9eaf4a2df8f9a6590397e591609da7e045
                                                                                                                              • Instruction Fuzzy Hash: 3EF0543634830179EF28B3E26E47B993769AF40B16F500829F514D50D2EFA8C8498715
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09784D Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __initterm_e
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4027532054-0
                                                                                                                              • Opcode ID: 229f30e189c603cd2eeff288f8459769f2de3013cbc26727c14bb3420f2b7858
                                                                                                                              • Instruction ID: 7ca7d36940307a2c5153f4bf050a352551f0c72d0a0cb8509c99ff39b482f30b
                                                                                                                              • Opcode Fuzzy Hash: 229f30e189c603cd2eeff288f8459769f2de3013cbc26727c14bb3420f2b7858
                                                                                                                              • Instruction Fuzzy Hash: DEF0BE733852046AFB0422FC6C08B8E37F89F0531EF202435E428E6EC1EF20D042E011
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09713B Relevance: 1.5, APIs: 1, Instructions: 39COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fclose_nolock
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4232755567-0
                                                                                                                              • Opcode ID: 7fc3267de95c06db80155180c486243b606bec7bbc5329345c529c9638a197ad
                                                                                                                              • Instruction ID: 950f0f94a2e43f06d1a6f024672e969833e71cb6080b843a164c98d2f6718bb6
                                                                                                                              • Opcode Fuzzy Hash: 7fc3267de95c06db80155180c486243b606bec7bbc5329345c529c9638a197ad
                                                                                                                              • Instruction Fuzzy Hash: FEF0C272C016009BC711AB6D8C007CE7AF05F81334F14A745D47897BD0CB386606BE56
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69751911 Relevance: 1.5, APIs: 1, Instructions: 29COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __calloc_impl
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2175177749-0
                                                                                                                              • Opcode ID: 0f20a837f93326a4025be3b2bbf171935fb245581a7509884b240fb5b1cbe05a
                                                                                                                              • Instruction ID: 393c4765eb5f63b6e16584d8a02f8baf9c5b622e14ef666649b743d3ae3777c0
                                                                                                                              • Opcode Fuzzy Hash: 0f20a837f93326a4025be3b2bbf171935fb245581a7509884b240fb5b1cbe05a
                                                                                                                              • Instruction Fuzzy Hash: A2E06D7EA00218ABCB518E999A01B9E36A9ABC06A5F114475EC06E7114EFB0DA20D6A0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8E40D Relevance: 1.5, APIs: 1, Instructions: 29COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __calloc_impl
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2175177749-0
                                                                                                                              • Opcode ID: 036c3dd94c1a7d239b4fe79d371a8158f3537555fa9b21d57610d5a54f349ae4
                                                                                                                              • Instruction ID: 3915850fe5274b19a44690fab1b56b45ece2b610bd2281210f44ea60a59b788e
                                                                                                                              • Opcode Fuzzy Hash: 036c3dd94c1a7d239b4fe79d371a8158f3537555fa9b21d57610d5a54f349ae4
                                                                                                                              • Instruction Fuzzy Hash: 78E06D76601114ABDF21BB889902ADA76EDEB84764F194061BD09A7101D672DE01D7A2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09813A Relevance: 1.5, APIs: 1, Instructions: 29COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __calloc_impl
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2175177749-0
                                                                                                                              • Opcode ID: 100eea5b0c52ac80efb81ab6c7dec1ed5e7b7967733a5c4d771986ec6da5406a
                                                                                                                              • Instruction ID: 88a1c7fd6c228f9dd47560117f308f4eaf982b9d1b67225d308199421b906e60
                                                                                                                              • Opcode Fuzzy Hash: 100eea5b0c52ac80efb81ab6c7dec1ed5e7b7967733a5c4d771986ec6da5406a
                                                                                                                              • Instruction Fuzzy Hash: 01E09276641154BBCB114A998C00BCE37FDDFC0BA8F25126AAD19E7704DB70EE04E7A0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8813B Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _doexit
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1975234786-0
                                                                                                                              • Opcode ID: eec7c2cc112c21125ee25011a3c9f5f8ceeb673401462026301a0a9824ced2cb
                                                                                                                              • Instruction ID: 83ddc58534daa1ac806c77a2d81b719f425bf1ca9e84004f734e03c3ae784859
                                                                                                                              • Opcode Fuzzy Hash: eec7c2cc112c21125ee25011a3c9f5f8ceeb673401462026301a0a9824ced2cb
                                                                                                                              • Instruction Fuzzy Hash: F6B0927258030877DA202542AC03F063A1987C0B60E640020BA0C191A1ADA2A9699189
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69751190 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _doexit
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1975234786-0
                                                                                                                              • Opcode ID: 0064640331f06d76350917e00ec120ee5b53a5213c5aaad59ef2a7315b403877
                                                                                                                              • Instruction ID: 04ede50c5a6ddecea6a2f22a914ff64a8f8e98061b463c210b530f06dc347007
                                                                                                                              • Opcode Fuzzy Hash: 0064640331f06d76350917e00ec120ee5b53a5213c5aaad59ef2a7315b403877
                                                                                                                              • Instruction Fuzzy Hash: 9CA00269FDC34022F8A099612D47F5422011760F16FD45060BB0D2C1C0EDCA92A84167
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0979B9 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _doexit
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1975234786-0
                                                                                                                              • Opcode ID: 0064640331f06d76350917e00ec120ee5b53a5213c5aaad59ef2a7315b403877
                                                                                                                              • Instruction ID: 5ed6c2aaab9988482aa9db716321dcb23e15b04af5c937d37ead9c7fa9258267
                                                                                                                              • Opcode Fuzzy Hash: 0064640331f06d76350917e00ec120ee5b53a5213c5aaad59ef2a7315b403877
                                                                                                                              • Instruction Fuzzy Hash: 00A00266BD470021F96151547C43FD526451750F05FD85050BB483D6C4B5C6265C9067
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Non-executed Functions

                                                                                                                              Function 6974C4A0 Relevance: 60.0, APIs: 11, Strings: 23, Instructions: 507timefileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _strrchr.LIBCMT ref: 6974C4FB
                                                                                                                              • FindFirstFileA.KERNEL32(?,?,?,?,?,00000000), ref: 6974C553
                                                                                                                              • FindClose.KERNEL32(00000000,?,?,00000000), ref: 6974C569
                                                                                                                              • FindFirstFileA.KERNEL32(?,?,?,?,00000000), ref: 6974C575
                                                                                                                              • FindClose.KERNEL32(00000000,?,?,00000000), ref: 6974C585
                                                                                                                              • _strrchr.LIBCMT ref: 6974C801
                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,00000001,inf,?,?,00000000), ref: 6974C897
                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,00000000), ref: 6974C8AF
                                                                                                                              • _strrchr.LIBCMT ref: 6974C9FC
                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,00000001,chm,?,?,00000000), ref: 6974CA43
                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,00000000), ref: 6974CA5F
                                                                                                                              Strings
                                                                                                                              • binary data is not same., xrefs: 6974C793
                                                                                                                              • Newer version is available., xrefs: 6974C9E5
                                                                                                                              • Source DX version is %d.%02d.%02d.%04d, xrefs: 6974CB70
                                                                                                                              • Target DX version: %d.%02d.%02d.%04d, Timestamp: %d/%02d/%02d %02d:%02d:%02d.%02d, xrefs: 6974CAC1
                                                                                                                              • Unable to get Version on target file %s, xrefs: 6974C51C
                                                                                                                              • Force Copy!, xrefs: 6974C69E, 6974C7D0
                                                                                                                              • Warning: CompareBinary(): Unable to get check sum., xrefs: 6974C788
                                                                                                                              • Unable to get Version on source file %s, xrefs: 6974C53E
                                                                                                                              • Target file: '%s' Target file is Version %d.%d.%d.%dSource file is Version %d.%d.%d.%d, xrefs: 6974C673
                                                                                                                              • Currently %s is newer than the one being installed, xrefs: 6974C79F
                                                                                                                              • chm, xrefs: 6974CA0B
                                                                                                                              • Target DX version is %d.%02d.%02d.%04d, xrefs: 6974CB4A
                                                                                                                              • cat, xrefs: 6974C506
                                                                                                                              • Target DriverVer is "%s, %d.%02d.%02d.%04d", xrefs: 6974C9AB
                                                                                                                              • CheckVersions(): CheckForceCopy() failed., xrefs: 6974C7DE
                                                                                                                              • Target DriverVer: "%s, %d.%02d.%02d.%04d", Timestamp: %d/%02d/%02d %02d:%02d:%02d.%02d, xrefs: 6974C914
                                                                                                                              • CheckVersions(): GetDriverVerFromInf() failed., xrefs: 6974C83D
                                                                                                                              • Newer file is available., xrefs: 6974CB7D
                                                                                                                              • inf, xrefs: 6974C810
                                                                                                                              • Source DX version: %d.%02d.%02d.%04d, Timestamp: %d/%02d/%02d %02d:%02d:%02d.%02d, xrefs: 6974CB1F
                                                                                                                              • Source DriverVer is "%s, %d.%02d.%02d.%04d", xrefs: 6974C9D8
                                                                                                                              • SourceLangID = 0x%04X, TargetLangID = 0x%04X, xrefs: 6974C776
                                                                                                                              • Source DriverVer: "%s, %d.%02d.%02d.%04d", Timestamp: %d/%02d/%02d %02d:%02d:%02d.%02d, xrefs: 6974C979
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Time$File$FindSystem$_strrchr$CloseFirst
                                                                                                                              • String ID: CheckVersions(): CheckForceCopy() failed.$CheckVersions(): GetDriverVerFromInf() failed.$Currently %s is newer than the one being installed$Force Copy!$Newer file is available.$Newer version is available.$Source DX version is %d.%02d.%02d.%04d$Source DX version: %d.%02d.%02d.%04d, Timestamp: %d/%02d/%02d %02d:%02d:%02d.%02d$Source DriverVer is "%s, %d.%02d.%02d.%04d"$Source DriverVer: "%s, %d.%02d.%02d.%04d", Timestamp: %d/%02d/%02d %02d:%02d:%02d.%02d$SourceLangID = 0x%04X, TargetLangID = 0x%04X$Target DX version is %d.%02d.%02d.%04d$Target DX version: %d.%02d.%02d.%04d, Timestamp: %d/%02d/%02d %02d:%02d:%02d.%02d$Target DriverVer is "%s, %d.%02d.%02d.%04d"$Target DriverVer: "%s, %d.%02d.%02d.%04d", Timestamp: %d/%02d/%02d %02d:%02d:%02d.%02d$Target file: '%s' Target file is Version %d.%d.%d.%dSource file is Version %d.%d.%d.%d$Unable to get Version on source file %s$Unable to get Version on target file %s$Warning: CompareBinary(): Unable to get check sum.$binary data is not same.$cat$chm$inf
                                                                                                                              • API String ID: 502818252-3991829042
                                                                                                                              • Opcode ID: 05aa16fd8c616924d03aba12582ed48581ff83b4e6086b65e64811cf73665900
                                                                                                                              • Instruction ID: 10ce118f9440a3f5b36a350c7bff93e3e6d8459e1ff3ba08cb37bb8752b6c7fd
                                                                                                                              • Opcode Fuzzy Hash: 05aa16fd8c616924d03aba12582ed48581ff83b4e6086b65e64811cf73665900
                                                                                                                              • Instruction Fuzzy Hash: C90296B5540129BADF64CB558F44BFAB3FCAB18B02F044596F988E6042EB34DE94DB31
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8390A Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 200windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                              • __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A83803: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A83839
                                                                                                                                • Part of subcall function 00A83803: OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.), ref: 00A83848
                                                                                                                                • Part of subcall function 00A83803: CreateDirectoryA.KERNEL32(?,00000000), ref: 00A83888
                                                                                                                                • Part of subcall function 00A83803: GetLastError.KERNEL32 ref: 00A83892
                                                                                                                              • _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              • FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00A83A9A
                                                                                                                              • LocalFree.KERNEL32(?), ref: 00A83ABF
                                                                                                                              • GetLastError.KERNEL32 ref: 00A83AC7
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectoryErrorLast__wstrtime$CreateDebugFormatFreeLocalMessageOutputStringWindows_strrchr
                                                                                                                              • String ID: $ Error:$ Failed API:%s$ File in process:$ - $ module: %s(%s), file: %s, line: %d, function: %s$%s(): %s$%s(): %s failed, error = %d.$%s(): %s failed, error = 0x%x.$%s(): %s failed.$(%d)$(0x%x)$--------------------$DXSError(): FormatMessage() failed, error = %d.$DXSError(): FormatMessage() failed, system cannot find message text for error.$DXSetup$Mar 30 2011$[%s %s]
                                                                                                                              • API String ID: 3982051927-2477982902
                                                                                                                              • Opcode ID: 0e87892cbb9b1052a4b906f028563dffb64921b020e0abf33fccdee78c1b8b5f
                                                                                                                              • Instruction ID: 28709c8deaf266f30626eddb2e31e5a5bec909adcc3892598f010a2a81497191
                                                                                                                              • Opcode Fuzzy Hash: 0e87892cbb9b1052a4b906f028563dffb64921b020e0abf33fccdee78c1b8b5f
                                                                                                                              • Instruction Fuzzy Hash: 2C6180B2D04219BBDF25FBA5CD4AEEF7B6CEF04B40F1004A5F509A6142EB719B458B60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69747D53 Relevance: 38.7, APIs: 10, Strings: 12, Instructions: 169COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetLastError.KERNEL32(0000000D), ref: 69747D93
                                                                                                                              • SetLastError.KERNEL32(00000057,?,00000004,69741A1C), ref: 69747DFB
                                                                                                                              • FindResourceA.KERNEL32 ref: 69747E45
                                                                                                                              • GetLastError.KERNEL32(Unable to find EULA %s.,?,?,?,?), ref: 69747E5B
                                                                                                                              • SizeofResource.KERNEL32(?,00000000,?,?,?,?), ref: 69747E8D
                                                                                                                              • SetLastError.KERNEL32(0000007A,?,?,?,?,?), ref: 69747EAD
                                                                                                                              • LoadResource.KERNEL32(?,?,?,?,?,?,?), ref: 69747ED1
                                                                                                                              • GetLastError.KERNEL32(00000000,?,?,?,?,?), ref: 69747EDC
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$Resource$FindLoadSizeof
                                                                                                                              • String ID: DATA$EULA text is invalid.$FindResource()$Insufficient buffer.$Invalid parameter - output buffer is NULL.$LoadResource()$LockResource()$SETUP_AGREEMENT_%s$Unable to find EULA %s.$Unable to find EULA for the specified language.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\eula.cpp$iDirectXSetupGetEULAA
                                                                                                                              • API String ID: 353423887-1232173623
                                                                                                                              • Opcode ID: eff144d939a91e70d1d3fcc8518157f15afbe0d0c04ef9cb7d3dcc9a6379bf83
                                                                                                                              • Instruction ID: 8e9ab5012df36677afa7a2804164aea5b02fc75a6cfcd1c42bc8a90261dab6cd
                                                                                                                              • Opcode Fuzzy Hash: eff144d939a91e70d1d3fcc8518157f15afbe0d0c04ef9cb7d3dcc9a6379bf83
                                                                                                                              • Instruction Fuzzy Hash: E95193B5944289FFDB00BBA4CF45EAE3B68FB25F44F804936F601A6053E7309A158F60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974A3CE Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 152filestringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindFirstFileA.KERNEL32(?,?,?,?,\*.*), ref: 6974A416
                                                                                                                              • lstrcmpA.KERNEL32(?,69742CC8), ref: 6974A444
                                                                                                                              • lstrcmpA.KERNEL32(?,69742CC4), ref: 6974A45E
                                                                                                                                • Part of subcall function 69749A47: _strrchr.LIBCMT ref: 69749A51
                                                                                                                              • GetFileAttributesA.KERNEL32(?), ref: 6974A4E1
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6974A4ED
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              • FindNextFileA.KERNEL32(?,?), ref: 6974A57F
                                                                                                                              • FindClose.KERNEL32(?), ref: 6974A593
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileFind$__wstrtime_strrchrlstrcmp$AttributesCloseErrorFirstLastNext
                                                                                                                              • String ID: CleanUpDirectory$DeleteFile("%s") return 0, reason = %d.$GetFileAttributes()$Unable to create path string, %s\%s.$Unable to create path string, %s\*.*.$Unable to remove: %s which is locked, reason = %d.$\*.*$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h
                                                                                                                              • API String ID: 338635360-3006747567
                                                                                                                              • Opcode ID: 6b54156af0a5c83b91fd425231b4d3dfb37ce3b735c6d0f923739ab93c0e2eb8
                                                                                                                              • Instruction ID: 390ae5ec84b07195ae17b8e56dc18435c7997cf1b465732cad970b378966c2e1
                                                                                                                              • Opcode Fuzzy Hash: 6b54156af0a5c83b91fd425231b4d3dfb37ce3b735c6d0f923739ab93c0e2eb8
                                                                                                                              • Instruction Fuzzy Hash: DB41C2B598015CAADB10EAA58F88EEFB77CEB15F54F4040B2B509E2052E7309F958F60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A86964 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 142shutdownCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00A869D3
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 00A869DE
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              • #17.COMCTL32(?,?,?,?,?), ref: 00A86AE2
                                                                                                                              • ExitWindowsEx.USER32(00000002,00000000), ref: 00A86B13
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$DirectoryErrorExitLastSystemWindows_strrchr
                                                                                                                              • String ID: GetFileVersion() failed.$GetSystemDirectory()$P$StartWizard$StartWizard()$Unable to create path string, %s%s.$Win95(): This platform is not supported.$\comctl32.dll$comctl32.dll version: %d.%02d.%02d.%04d$e:\bt\382730\setup\deliverables\dxsetup\psheets.cpp$reboot system
                                                                                                                              • API String ID: 1959146012-4094694292
                                                                                                                              • Opcode ID: 03845ed13d3d9417be647f226395ba2cf379060b476e2e121177bf3b068f1796
                                                                                                                              • Instruction ID: 01581b8d05ad9d999440c6858c69acd86f2d4b520588f27ae2ec880c8dfd55d0
                                                                                                                              • Opcode Fuzzy Hash: 03845ed13d3d9417be647f226395ba2cf379060b476e2e121177bf3b068f1796
                                                                                                                              • Instruction Fuzzy Hash: CD41F772E4022476EB28B7A18D4AFFB767CAB41B04F104555FE45F6082EA649E81C7B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A84163 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 65COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 00A84176
                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,000F01FF,?), ref: 00A84186
                                                                                                                              • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00A8419C
                                                                                                                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00A841CB
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00A841D4
                                                                                                                              • FreeLibrary.KERNEL32(6C090000), ref: 00A841E4
                                                                                                                              • GetLastError.KERNEL32 ref: 00A841EE
                                                                                                                              Strings
                                                                                                                              • EnableReboot, xrefs: 00A841FF
                                                                                                                              • SeShutdownPrivilege, xrefs: 00A84196
                                                                                                                              • e:\bt\382730\setup\deliverables\dxsetup\dxsetup.cpp, xrefs: 00A84209
                                                                                                                              • FreeLibrary(), xrefs: 00A841FA
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ProcessToken$AdjustCloseCurrentErrorFreeHandleLastLibraryLookupOpenPrivilegePrivilegesValue
                                                                                                                              • String ID: EnableReboot$FreeLibrary()$SeShutdownPrivilege$e:\bt\382730\setup\deliverables\dxsetup\dxsetup.cpp
                                                                                                                              • API String ID: 274012654-347618328
                                                                                                                              • Opcode ID: cd6e7f0de003b79a48e13f08d46c75ee94eab8be71466bab2e16e0524b404728
                                                                                                                              • Instruction ID: fee92f6df32c92149fa719c7a58be32d5a1c3a4f9dfde3aad3c3e3fb0fd14ed1
                                                                                                                              • Opcode Fuzzy Hash: cd6e7f0de003b79a48e13f08d46c75ee94eab8be71466bab2e16e0524b404728
                                                                                                                              • Instruction Fuzzy Hash: 4B113771A4121AABCB10EFE5DD4AEEFBBBCEF19741B000519F505E2150EB7499428BA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A9152E Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 135memorylibraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __get_wpgmptr.LIBCMT ref: 00A9154C
                                                                                                                              • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00A91577
                                                                                                                              • GetSystemInfo.KERNEL32(?), ref: 00A9158F
                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00A915B8
                                                                                                                              • GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00A915C8
                                                                                                                              • VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 00A9164F
                                                                                                                              • VirtualProtect.KERNEL32(?,?,?,?), ref: 00A91662
                                                                                                                                • Part of subcall function 00A8A451: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 00A8A4E5
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Virtual$AddressAllocDebugHandleInfoModuleOutputProcProtectQueryStringSystem__get_wpgmptr
                                                                                                                              • String ID: SetThreadStackGuarantee$kernel32.dll
                                                                                                                              • API String ID: 2401657611-423161677
                                                                                                                              • Opcode ID: 256d9c796bf69bd6862eb7f1851e519563b9b7c2dfb5645488f01faf7022e415
                                                                                                                              • Instruction ID: b040a616ce66ce0c784ed63c6dd02160808a4c89aba989ef5f7e9d65cc52eb68
                                                                                                                              • Opcode Fuzzy Hash: 256d9c796bf69bd6862eb7f1851e519563b9b7c2dfb5645488f01faf7022e415
                                                                                                                              • Instruction Fuzzy Hash: 60418276E0020AABCF11EFE1DD85EEEBBF9EF84741F150466E616E6140E7309A45CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974C3A6 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 82COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetPrivateProfileStringA.KERNEL32(Version,DriverVer,69741EA0,?,00000104,?), ref: 6974C3F8
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: PrivateProfileString
                                                                                                                              • String ID: DriverVer$GetDriverVerFromInf(): StringToVersionInfo() failed.$GetDriverVerFromInf(): Unable to find %s from %s.$GetDriverVerFromInf(): Unable to get %s from %s.$Version
                                                                                                                              • API String ID: 1096422788-1349852725
                                                                                                                              • Opcode ID: d890fa52c8d31d5aa168b4d51a3b0045e2061c9bdb95c42f350f184d44885bfa
                                                                                                                              • Instruction ID: bb38ccc5cbfedfa9d40676c07f10f8a66fec001031e8337ace94c984c6f24380
                                                                                                                              • Opcode Fuzzy Hash: d890fa52c8d31d5aa168b4d51a3b0045e2061c9bdb95c42f350f184d44885bfa
                                                                                                                              • Instruction Fuzzy Hash: 1621D6B9900158BBDF50DB698F49FEB7BBC9B55B45F0444B4A44CD2102EB708A44CBA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A920B3 Relevance: 9.2, APIs: 6, Instructions: 156memoryfileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00A8ECF3: SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,?,00A8EF80,?,00000000,00000000,00000002,00000000,00000000), ref: 00A8ED35
                                                                                                                                • Part of subcall function 00A8ECF3: GetLastError.KERNEL32(?,00A8EF80,?,00000000,00000000,00000002,00000000,00000000,?), ref: 00A8ED42
                                                                                                                                • Part of subcall function 00A8ECF3: __dosmaperr.LIBCMT ref: 00A8ED4D
                                                                                                                              • GetProcessHeap.KERNEL32(00000008,00001000,?,?,?,?,?,00000000,00000109,00000000,?,?,00A902ED,00000109,?), ref: 00A9211C
                                                                                                                              • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000,00000109,00000000,?,?,00A902ED,00000109,?), ref: 00A92123
                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,00A902ED), ref: 00A9219F
                                                                                                                              • HeapFree.KERNEL32(00000000), ref: 00A921A6
                                                                                                                              • SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,00A902ED), ref: 00A92201
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,00A902ED,00000109), ref: 00A9222E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Heap$ErrorFileLastProcess$AllocFreePointer__dosmaperr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3789379547-0
                                                                                                                              • Opcode ID: 73f0673c30ff27b7455e29d10a684da42274c7413c157d0a0752ccc03a268359
                                                                                                                              • Instruction ID: 4835446139d5975101f4fd0fb5e73cd1393170cc75062e2c05e07a9bbb64c314
                                                                                                                              • Opcode Fuzzy Hash: 73f0673c30ff27b7455e29d10a684da42274c7413c157d0a0752ccc03a268359
                                                                                                                              • Instruction Fuzzy Hash: DA41D572A00519BFDF246FBCCC467AD7AB6EB00360F254325FA38961E0D7714DA28B91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974FC2E Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32 ref: 69754055
                                                                                                                              • UnhandledExceptionFilter.KERNEL32(69744DF4), ref: 69754060
                                                                                                                              • GetCurrentProcess.KERNEL32(C0000409), ref: 6975406B
                                                                                                                              • TerminateProcess.KERNEL32(00000000), ref: 69754072
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3231755760-0
                                                                                                                              • Opcode ID: 9a99f94abd4fb30960e2ca1ad195cb71c87c4cccd4334dbd602aa22878a20916
                                                                                                                              • Instruction ID: e55c8b043e84231d19277e9c2590ae327a74864aeccc3d112b7a51db0e590ff9
                                                                                                                              • Opcode Fuzzy Hash: 9a99f94abd4fb30960e2ca1ad195cb71c87c4cccd4334dbd602aa22878a20916
                                                                                                                              • Instruction Fuzzy Hash: 7A21C0B5405288EFEBC0EF68C5866747BB4BF0A304B40447AE40A83B41EF705981CF46
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8765E Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32 ref: 00A8B3E1
                                                                                                                              • UnhandledExceptionFilter.KERNEL32(00A8298C), ref: 00A8B3EC
                                                                                                                              • GetCurrentProcess.KERNEL32(C0000409), ref: 00A8B3F7
                                                                                                                              • TerminateProcess.KERNEL32(00000000), ref: 00A8B3FE
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3231755760-0
                                                                                                                              • Opcode ID: 18130c764048299009b41f328e57a3d9749ff8127540e1156f9a9f69222d26d4
                                                                                                                              • Instruction ID: 7d8954246b2777f60d3c64ef931cc41447560630d86511867973615160160b7f
                                                                                                                              • Opcode Fuzzy Hash: 18130c764048299009b41f328e57a3d9749ff8127540e1156f9a9f69222d26d4
                                                                                                                              • Instruction Fuzzy Hash: 202176B8A05204AFDB40DFAEED896867BF8BB08301B50455EEA0897360EF755986CF15
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C096DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32 ref: 6C09AA5B
                                                                                                                              • UnhandledExceptionFilter.KERNEL32(6C0925F0), ref: 6C09AA66
                                                                                                                              • GetCurrentProcess.KERNEL32(C0000409), ref: 6C09AA71
                                                                                                                              • TerminateProcess.KERNEL32(00000000), ref: 6C09AA78
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3231755760-0
                                                                                                                              • Opcode ID: 39838c2905312ff985225f1658e17a75a9dc83af094f8b31db7742447d6b6532
                                                                                                                              • Instruction ID: f195c55a56c930d18c1820a62367ce6a7c6864c664339e470d716ded1df88327
                                                                                                                              • Opcode Fuzzy Hash: 39838c2905312ff985225f1658e17a75a9dc83af094f8b31db7742447d6b6532
                                                                                                                              • Instruction Fuzzy Hash: 6621C0BCB12E04EBCF11CFE9E18468C7BF8BB4A321B50651AE5098B222EF7055419F59
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A87499 Relevance: 1.6, APIs: 1, Instructions: 78timeCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLocalTime.KERNEL32(00A83734,?,00000000,?,00A83734), ref: 00A874C7
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: LocalTime
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 481472006-0
                                                                                                                              • Opcode ID: fe60385a0b4a8e44bd3c590705d0f71e9425bf05234111a3ecd38b41c426ce32
                                                                                                                              • Instruction ID: 45c0e980be7516b860955ce670ac18846ad4cbec6b289f2bc1dfa25e8eb472df
                                                                                                                              • Opcode Fuzzy Hash: fe60385a0b4a8e44bd3c590705d0f71e9425bf05234111a3ecd38b41c426ce32
                                                                                                                              • Instruction Fuzzy Hash: 4F115E623093909BD7207BAD64C56DE7BE59F66320F28C46EF1D547283C071D94DC722
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A87E8A Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32 ref: 00A87E8F
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterUnhandled
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3192549508-0
                                                                                                                              • Opcode ID: 606966faaa2797368752898825483f40b55c0407590a644d7d130c4a922b4fb8
                                                                                                                              • Instruction ID: e37445c8cd55bde0e102fa82a4559a3e33d3b0eda33bf00b7713102eb86c1e06
                                                                                                                              • Opcode Fuzzy Hash: 606966faaa2797368752898825483f40b55c0407590a644d7d130c4a922b4fb8
                                                                                                                              • Instruction Fuzzy Hash: 559002702565115E560067B05D4E54925957B6C702B5119946105D4458DB5485035751
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A85781 Relevance: 100.0, APIs: 55, Strings: 2, Instructions: 240windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetWindowLongA.USER32(?,000000EB), ref: 00A857A2
                                                                                                                              • SetWindowLongA.USER32(?,000000EB,?), ref: 00A857C8
                                                                                                                              • GetDlgItem.USER32(?,00001389), ref: 00A857DA
                                                                                                                              • SendMessageA.USER32 ref: 00A857E3
                                                                                                                              • GetDlgItem.USER32(?,0000138A), ref: 00A857F5
                                                                                                                              • SendMessageA.USER32 ref: 00A857F8
                                                                                                                              • GetDlgItem.USER32(?,0000138B), ref: 00A8580A
                                                                                                                              • GetParent.USER32(?), ref: 00A8583C
                                                                                                                              • PostMessageA.USER32 ref: 00A85845
                                                                                                                              • GetParent.USER32(?), ref: 00A85851
                                                                                                                              • PostMessageA.USER32 ref: 00A85854
                                                                                                                              • GetDlgItem.USER32(?,00001389), ref: 00A85879
                                                                                                                              • ShowWindow.USER32(00000000), ref: 00A85882
                                                                                                                              • GetDlgItem.USER32(?,0000138A), ref: 00A8588C
                                                                                                                              • ShowWindow.USER32(00000000), ref: 00A8588F
                                                                                                                              • GetDlgItem.USER32(?,0000138B), ref: 00A85899
                                                                                                                              • ShowWindow.USER32(00000000), ref: 00A8589C
                                                                                                                              • GetDlgItem.USER32(?,0000138C), ref: 00A858A6
                                                                                                                              • ShowWindow.USER32(00000000), ref: 00A858A9
                                                                                                                              • GetDlgItem.USER32(?,0000138D), ref: 00A858B3
                                                                                                                              • ShowWindow.USER32(00000000), ref: 00A858B6
                                                                                                                              • GetDlgItem.USER32(?,00001397), ref: 00A8590B
                                                                                                                              • ShowWindow.USER32(00000000), ref: 00A8590E
                                                                                                                              • GetDlgItem.USER32(?,0000138E), ref: 00A85918
                                                                                                                              • ShowWindow.USER32(00000000), ref: 00A8591B
                                                                                                                              • SendMessageA.USER32 ref: 00A859EC
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Item$Window$Show$Message$Send$LongParentPost
                                                                                                                              • String ID: N$PropSheet_RebootSystem()
                                                                                                                              • API String ID: 1264772791-752106098
                                                                                                                              • Opcode ID: 93176cb2a4c8444e580ccb62fcdbbb67f2b754502824a457de80e676cec9f1b9
                                                                                                                              • Instruction ID: cb217ca891c38ad619f315d3e6106e1caebd57c027cb74786ec05ca017f57fa7
                                                                                                                              • Opcode Fuzzy Hash: 93176cb2a4c8444e580ccb62fcdbbb67f2b754502824a457de80e676cec9f1b9
                                                                                                                              • Instruction Fuzzy Hash: 7E613EB1E80318B6EB307BB19C4EF9B3E1C9B84B61F110916B705BA0D1DDB89941CFA4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697479F6 Relevance: 84.3, APIs: 24, Strings: 24, Instructions: 268stringwindowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • EndDialog.USER32 ref: 69747A44
                                                                                                                              • lstrcmpA.KERNEL32(?,CHS,?,?), ref: 69747A9C
                                                                                                                              • lstrcmpA.KERNEL32(?,CHT,?,?), ref: 69747AB7
                                                                                                                              • lstrcmpA.KERNEL32(?,CZE,?,?), ref: 69747AD2
                                                                                                                              • lstrcmpA.KERNEL32(?,DUT,?,?), ref: 69747AED
                                                                                                                              • lstrcmpA.KERNEL32(?,FRN,?,?), ref: 69747B08
                                                                                                                              • FindResourceA.KERNEL32 ref: 69747C0A
                                                                                                                              • GetLastError.KERNEL32(Unable to find EULA %s.,?,?,?), ref: 69747C1D
                                                                                                                              • LoadResource.KERNEL32(?,00000000,?,?), ref: 69747C4E
                                                                                                                              • GetLastError.KERNEL32(Unable to load EULA %s.,?,?,?), ref: 69747C64
                                                                                                                              • _memset.LIBCMT ref: 69747CC5
                                                                                                                              • SetDlgItemTextA.USER32(?,00001B59,00000000), ref: 69747CE4
                                                                                                                              • SendDlgItemMessageA.USER32(?,00001B59,000000B1,000000FF,00000000), ref: 69747CF7
                                                                                                                              • EndDialog.USER32 ref: 69747D0C
                                                                                                                              • SendDlgItemMessageA.USER32(?,00001B59,000000B1,000000FF,00000000), ref: 69747D2C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: lstrcmp$Item$DialogErrorLastMessageResourceSend$FindLoadText_memset
                                                                                                                              • String ID: 4$BRZ$CHS$CHT$CZE$DATA$DUT$EulaProc$FRN$FindResource()$GER$ITN$JPN$KOR$LoadResource()$POL$RUS$SETUP_AGREEMENT_%s$SPA$SWE$Unable to allocate memory block for EULA %s.$Unable to find EULA %s.$Unable to load EULA %s.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\eula.cpp
                                                                                                                              • API String ID: 3965438891-736825585
                                                                                                                              • Opcode ID: 07a34b4d31a5ea7d3f6872dd22e18b0185ae3e7783b6c9be35c417fa5ebebc5f
                                                                                                                              • Instruction ID: b53ea35331fdebd380bbaaf18c8500bd1d105e7e9623cbd586b67b4c071fab83
                                                                                                                              • Opcode Fuzzy Hash: 07a34b4d31a5ea7d3f6872dd22e18b0185ae3e7783b6c9be35c417fa5ebebc5f
                                                                                                                              • Instruction Fuzzy Hash: B4917435D4420AEADF00EBA5CF46EEE7BB8AB16F88F404426E500F6043E774D615CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0951B3 Relevance: 77.4, APIs: 26, Strings: 18, Instructions: 445COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Library__wstrtime$AddressFreeLoadProcVersion_strrchr
                                                                                                                              • String ID: Application name is too long, %s.$Current logon user doesn't have the Administrator privilege.$DirectXRegisterApplicationA$DirectXRegisterApplicationA: Completed.$DirectXRegisterApplicationA: ERROR!$Function pointer XDirectXLoadString is not initialized.$Invalid parameter - struct pointer is NULL.$LoadDSetup32() failed.$RegCloseKey()$RegCloseKey() failed$RegCreateKeyExA()$RegSetValueExA()$RegSetValueExA().$StringFromGUID2()$Unable to convert GUID from UNICODE to ANSI.$WideCharToMultiByte()$XDirectXLoadString() failed.$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 2044236047-2435350783
                                                                                                                              • Opcode ID: c968e8c5e37434892707a938d2aeb98ff8abe54603576dda87df11c951272fc9
                                                                                                                              • Instruction ID: d414e1451bc79eb2501253937048ae303044cada43f16621388b75b2327c221f
                                                                                                                              • Opcode Fuzzy Hash: c968e8c5e37434892707a938d2aeb98ff8abe54603576dda87df11c951272fc9
                                                                                                                              • Instruction Fuzzy Hash: 23D1B8B57442147AFB208A629C05FFB3AFCEB02756F102555FB18E68C1EA70D940EEB5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0957D6 Relevance: 65.2, APIs: 20, Strings: 17, Instructions: 455registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 6C095E51: GetVersionExA.KERNEL32(?), ref: 6C095E7E
                                                                                                                                • Part of subcall function 6C095E51: LoadLibraryA.KERNEL32(advpack.dll), ref: 6C095EBA
                                                                                                                                • Part of subcall function 6C095E51: GetProcAddress.KERNEL32(00000000,IsNTAdmin), ref: 6C095ECE
                                                                                                                                • Part of subcall function 6C095E51: FreeLibrary.KERNEL32(00000000), ref: 6C095F1A
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 6C095842
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C09584D
                                                                                                                              • _wcsnlen.LIBCMT ref: 6C09591B
                                                                                                                              • _wcsnlen.LIBCMT ref: 6C095935
                                                                                                                              • RegCreateKeyExW.ADVAPI32(80000002,?,00000000,00000000,00000000,00000002,00000000,?,?), ref: 6C0959AC
                                                                                                                              • StringFromGUID2.OLE32(?,?,00000104), ref: 6C0959D7
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6C095D0F
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6C095D4B
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseLibraryVersion_wcsnlen$AddressCreateErrorFreeFromLastLoadProcString
                                                                                                                              • String ID: GetVersionEx()$Application name is too long.$Current logon user doesn't have the Administrator privilege.$DirectXRegisterApplicationW$DirectXRegisterApplicationW:$DirectXRegisterApplicationW: Completed.$DirectXRegisterApplicationW: ERROR!$Invalid parameter - struct pointer is NULL.$MyLoadStringW() failed.$MyLoadStringW().$Not running NT 4.0. Version: [%08X]$Not running NT. Platform ID: [%08X]$RegCloseKey()$RegCreateKeyExW()$RegSetValueExW()$StringFromGUID2()$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 187334128-611565798
                                                                                                                              • Opcode ID: 3d820d506585171a3494be6c06d7719c8557952097180c900052bcc2685edeaf
                                                                                                                              • Instruction ID: a82378690b86b51e4a7c495c23837abfe859fd065df4fe73498c161b0df26d8e
                                                                                                                              • Opcode Fuzzy Hash: 3d820d506585171a3494be6c06d7719c8557952097180c900052bcc2685edeaf
                                                                                                                              • Instruction Fuzzy Hash: FAD11BF5645208BEFB205A528C85FAB72FDD74134AF402A65F509F6C82EB31AD54FE20
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09432C Relevance: 63.3, APIs: 14, Strings: 22, Instructions: 297registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 6C095E51: GetVersionExA.KERNEL32(?), ref: 6C095E7E
                                                                                                                                • Part of subcall function 6C095E51: LoadLibraryA.KERNEL32(advpack.dll), ref: 6C095EBA
                                                                                                                                • Part of subcall function 6C095E51: GetProcAddress.KERNEL32(00000000,IsNTAdmin), ref: 6C095ECE
                                                                                                                                • Part of subcall function 6C095E51: FreeLibrary.KERNEL32(00000000), ref: 6C095F1A
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6C094694
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6C0946C2
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C096506
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C09650F
                                                                                                                                • Part of subcall function 6C0964D5: _strrchr.LIBCMT ref: 6C096555
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseLibrary__wstrtime$AddressFreeLoadProcVersion_strrchr
                                                                                                                              • String ID: App: $Current logon user doesn't have the Administrator privilege.$DirectXUnRegisterApplication$DirectXUnRegisterApplication:$DirectXUnRegisterApplication: Completed.$DirectXUnRegisterApplication: ERROR!$Guid$Index: %d$Invalid parameter - GUID is NULL.$RegCloseKey()$RegDeleteKey()$RegEnumKeyEx()$RegOpenKeyEx()$RegQueryInfoKey()$RegQueryValueEx()$SOFTWARE\Microsoft\DirectPlay\Applications$StringFromGUID2()$Unable to convert GUID from UNICODE to ANSI.$Unable to delete key %s.$Unable to find GUID.$WideCharToMultiByte()$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 3035098486-1639858186
                                                                                                                              • Opcode ID: 8bdbb2ba328def21ab8e3e0fe50acddafcc78da0afc4cbcf178ecab4e297ac8b
                                                                                                                              • Instruction ID: 79dc6a28a5512d3af7e975b68231ab99a13a24d34517f345eed26fe16147a56c
                                                                                                                              • Opcode Fuzzy Hash: 8bdbb2ba328def21ab8e3e0fe50acddafcc78da0afc4cbcf178ecab4e297ac8b
                                                                                                                              • Instruction Fuzzy Hash: 0DA1A8B2A04118BFEB109E908C84FEF72FEEB85349F0025D5F519E1940DB729F94AE65
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0939E0 Relevance: 56.2, APIs: 19, Strings: 13, Instructions: 201libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _memset.LIBCMT ref: 6C093A12
                                                                                                                              • _memset.LIBCMT ref: 6C093A2D
                                                                                                                              • _memset.LIBCMT ref: 6C093A42
                                                                                                                              • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 6C093A53
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C093A5E
                                                                                                                              • GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 6C093A90
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C093A9B
                                                                                                                              • SetCurrentDirectoryA.KERNEL32(00000000), ref: 6C093ABA
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C093AC5
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 6C093AF3
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C093B08
                                                                                                                              • LoadLibraryA.KERNEL32(00000000), ref: 6C093B9A
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C093BAB
                                                                                                                              • GetProcAddress.KERNEL32(00000000,DirectInputCreateA), ref: 6C093BC8
                                                                                                                              • GetLastError.KERNEL32(Module: %d, Function: DirectXInputCreateA,00000000), ref: 6C093BE4
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C096506
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C09650F
                                                                                                                                • Part of subcall function 6C0964D5: _strrchr.LIBCMT ref: 6C096555
                                                                                                                              • FreeLibrary.KERNEL32(?), ref: 6C093C05
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C093C10
                                                                                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 6C093C6C
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C093C77
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$Directory$Current_memset$Library__wstrtime$AddressFreeLoadProcSystemVersion_strrchr
                                                                                                                              • String ID: DirectInputCreateA$FreeLibrary()$GetCurrentDirectory()$GetProcAddress()$GetRunningDXVersion$GetSystemDirectory()$GetVersionEx()$LoadLibrary()$Module: %d, Function: DirectXInputCreateA$SetCurrentDirectory()$Unable to create path string, %s%s.$\DINPUT.DLL$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 3694406903-2033765323
                                                                                                                              • Opcode ID: b58d1952954fccfb35f63933a65b7cf947410fe0c86b4e2309c33031b24b246a
                                                                                                                              • Instruction ID: e70238448853e95ab7220ddc4744fb9a6d185f4e078bf7ce3489d78ae34faf6b
                                                                                                                              • Opcode Fuzzy Hash: b58d1952954fccfb35f63933a65b7cf947410fe0c86b4e2309c33031b24b246a
                                                                                                                              • Instruction Fuzzy Hash: 4B61F4B1B44214BBDB209FA58C48FDB7AFCAB0A704F006495F61DE3941DB70D680AF61
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A85F15 Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 272windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetWindowLongA.USER32(?,000000EB), ref: 00A85F23
                                                                                                                              • SendDlgItemMessageA.USER32(?,00001391,000000F1,00000000,00000000), ref: 00A85F71
                                                                                                                              • SendDlgItemMessageA.USER32(?,00001392,000000F1,00000001,00000000), ref: 00A85F83
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                                • Part of subcall function 00A86BDC: LoadStringW.USER32(00000000,0000006F,?,00000200), ref: 00A86C22
                                                                                                                                • Part of subcall function 00A86BDC: GetLastError.KERNEL32(00000000), ref: 00A86C2D
                                                                                                                              • SendDlgItemMessageA.USER32(?,00001391,000000F1,00000001,00000000), ref: 00A85FA2
                                                                                                                              • SendDlgItemMessageA.USER32(?,00001392,000000F1,00000000,00000000), ref: 00A85FB3
                                                                                                                              • SetWindowLongA.USER32(?,000000EB,?), ref: 00A85FF6
                                                                                                                              • GetDlgItem.USER32(?,00001389), ref: 00A86002
                                                                                                                              • SendMessageA.USER32 ref: 00A8600F
                                                                                                                              • GetParent.USER32(?), ref: 00A8607C
                                                                                                                              • PostMessageA.USER32 ref: 00A86083
                                                                                                                              • GetParent.USER32(?), ref: 00A8610B
                                                                                                                              • PostMessageA.USER32 ref: 00A86112
                                                                                                                              • SetDlgItemTextW.USER32 ref: 00A86127
                                                                                                                              • SendDlgItemMessageA.USER32(?,00001390,000000B1,000000FF,00000000), ref: 00A86139
                                                                                                                              • GetParent.USER32(?), ref: 00A8617D
                                                                                                                              • PostMessageA.USER32 ref: 00A86184
                                                                                                                              • GetParent.USER32(?), ref: 00A861CE
                                                                                                                              • PostMessageA.USER32 ref: 00A861D5
                                                                                                                              • GetParent.USER32(?), ref: 00A86200
                                                                                                                              • PostMessageA.USER32 ref: 00A86207
                                                                                                                              • SetWindowLongA.USER32(?,00000000,000000FF), ref: 00A86211
                                                                                                                              • SendDlgItemMessageA.USER32(?,00001390,000000B1,000000FF,00000000), ref: 00A8623C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$Item$Send$ParentPost$LongWindow$__wstrtime$ErrorLastLoadStringText_strrchr
                                                                                                                              • String ID: DirectXSEtupGetEULA() returned 0.$DirectXSetupGetEULA() returned 0.$IntroDlgProc$Unable to allocate memory block.$Unable to initialize CDSetup.$e:\bt\382730\setup\deliverables\dxsetup\psheets.cpp
                                                                                                                              • API String ID: 1260387990-844574282
                                                                                                                              • Opcode ID: 1dd40db78f1ad75ea034f5805fa8edf0ce2bdcf75267d5f8323d92bd1550f2e9
                                                                                                                              • Instruction ID: 9e304cfd7801178f7216dabbbb737c30c5805b4291862a1de2b56c2753cbac8d
                                                                                                                              • Opcode Fuzzy Hash: 1dd40db78f1ad75ea034f5805fa8edf0ce2bdcf75267d5f8323d92bd1550f2e9
                                                                                                                              • Instruction Fuzzy Hash: BF81B731A45221BBEB217FB59C4DFAB3E2CEF05B61F108619F719990E1D7B08942D7A0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A865CA Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 222COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _memset.LIBCMT ref: 00A865FA
                                                                                                                              • _memset.LIBCMT ref: 00A86620
                                                                                                                              • CreatePropertySheetPageA.COMCTL32(?,?,?,?,00000000,00000000,?), ref: 00A8669B
                                                                                                                              • CreatePropertySheetPageA.COMCTL32(00000034,?,?,?,00000000,00000000,?), ref: 00A866E6
                                                                                                                              • CreatePropertySheetPageA.COMCTL32(00000034,?,?,?,00000000,00000000,?), ref: 00A86731
                                                                                                                              • CreatePropertySheetPageA.COMCTL32(00000034,?,?,?,00000000,00000000,?), ref: 00A86768
                                                                                                                              • _memset.LIBCMT ref: 00A867EF
                                                                                                                              • SystemParametersInfoA.USER32(00000029,00000000,?,00000000), ref: 00A8680C
                                                                                                                              • GetDC.USER32(00000000), ref: 00A8681E
                                                                                                                              • GetModuleHandleA.KERNEL32(00000000,00001F4B,?,00000020,?,?,?,?,?,?,00000000,00000000,?), ref: 00A8683C
                                                                                                                              • LoadStringA.USER32 ref: 00A8683F
                                                                                                                              • CreateFontIndirectA.GDI32(?), ref: 00A8684F
                                                                                                                              • CreateFontIndirectA.GDI32(?), ref: 00A86862
                                                                                                                              • GetDeviceCaps.GDI32(?,0000005A), ref: 00A86872
                                                                                                                              • GetModuleHandleA.KERNEL32(00000000,00001F4A,?,00000020,?,?,?,?,?,?,00000000,00000000,?), ref: 00A86890
                                                                                                                              • LoadStringA.USER32 ref: 00A86893
                                                                                                                              • CreateFontIndirectA.GDI32(?), ref: 00A8689D
                                                                                                                              • ReleaseDC.USER32(00000000,?), ref: 00A868AC
                                                                                                                                • Part of subcall function 00A86CFA: LoadImageA.USER32(00A868CF,00001B5B,00000000,00000000,00000000,00002000), ref: 00A86D1A
                                                                                                                                • Part of subcall function 00A86CFA: CreateCompatibleDC.GDI32(00000000), ref: 00A86D28
                                                                                                                                • Part of subcall function 00A86CFA: SelectObject.GDI32(00000000), ref: 00A86D3C
                                                                                                                                • Part of subcall function 00A86CFA: LoadImageA.USER32(00A868CF,00001B5C,00000000,00000000,00000000,00002000), ref: 00A86D50
                                                                                                                                • Part of subcall function 00A86CFA: CreateCompatibleDC.GDI32(00000000), ref: 00A86D59
                                                                                                                                • Part of subcall function 00A86CFA: SelectObject.GDI32(00000000), ref: 00A86D67
                                                                                                                              • PropertySheetA.COMCTL32(00000034,?,?,?,?,?,?,?,00000000,00000000,?), ref: 00A868D6
                                                                                                                                • Part of subcall function 00A86D75: DeleteObject.GDI32(00000000), ref: 00A86D89
                                                                                                                                • Part of subcall function 00A86D75: DeleteObject.GDI32(00000000), ref: 00A86D9B
                                                                                                                                • Part of subcall function 00A86D75: DeleteObject.GDI32(00000000), ref: 00A86DAD
                                                                                                                                • Part of subcall function 00A86D75: DeleteDC.GDI32(00000000), ref: 00A86DC5
                                                                                                                                • Part of subcall function 00A86D75: DeleteDC.GDI32(00000000), ref: 00A86DD7
                                                                                                                                • Part of subcall function 00A86D75: DeleteDC.GDI32(00000000), ref: 00A86DE9
                                                                                                                              • GetLastError.KERNEL32(00000000,00000072,00000030,00000000,?,?,?,?,?,?,00000000,00000000,?), ref: 00A868F3
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              • DeleteObject.GDI32(?), ref: 00A8693A
                                                                                                                              • DeleteObject.GDI32(?), ref: 00A86942
                                                                                                                              • DeleteObject.GDI32(?), ref: 00A8694A
                                                                                                                                • Part of subcall function 00A86BDC: LoadStringW.USER32(00000000,0000006F,?,00000200), ref: 00A86C22
                                                                                                                                • Part of subcall function 00A86BDC: GetLastError.KERNEL32(00000000), ref: 00A86C2D
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateDelete$Object$LoadPropertySheet$Page$FontIndirectString_memset$CompatibleErrorHandleImageLastModuleSelect__wstrtime$CapsDeviceInfoParametersReleaseSystem_strrchr
                                                                                                                              • String ID: 4$4$CreatePropertySheet$PropertySheet()$e:\bt\382730\setup\deliverables\dxsetup\psheets.cpp
                                                                                                                              • API String ID: 1767149145-722558555
                                                                                                                              • Opcode ID: 1813539d99129e2cbd36a33f16e81b9bc0e6e4d493b26719c069fae79bbb1200
                                                                                                                              • Instruction ID: f4c93af10697f1a6c7441d1e6e85cef307ccf8e9ff95b64c5ecfdc851c229fae
                                                                                                                              • Opcode Fuzzy Hash: 1813539d99129e2cbd36a33f16e81b9bc0e6e4d493b26719c069fae79bbb1200
                                                                                                                              • Instruction Fuzzy Hash: 3B910DB1D412299FDB61EFA4CD89BDDBBB8BB09304F1045EAE508A7280D7749E858F50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C093ED3 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 236memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 6C095E22: CompareStringA.KERNEL32(00000409,00000001,?,000000FF,?,000000FF,?,6C093F1D,00000000,DLS,00000000,?), ref: 6C095E38
                                                                                                                              • _memset.LIBCMT ref: 6C093F2C
                                                                                                                              • mmioOpenA.WINMM(?,?,00000000), ref: 6C093F3C
                                                                                                                              • mmioDescend.WINMM(?,?,00000000,00000020), ref: 6C093F64
                                                                                                                              • mmioClose.WINMM(?,00000000), ref: 6C093F92
                                                                                                                              • mmioDescend.WINMM(?,?,?,00000010), ref: 6C093FD2
                                                                                                                              • mmioClose.WINMM(?,00000000), ref: 6C094000
                                                                                                                              • mmioRead.WINMM(?,?,00000008), ref: 6C094029
                                                                                                                              • mmioClose.WINMM(?,00000000), ref: 6C094058
                                                                                                                              • mmioClose.WINMM(?,00000000), ref: 6C09408B
                                                                                                                              • GetFileVersionInfoSizeA.VERSION(?,?,00000000,DLS,00000000,?), ref: 6C0940C5
                                                                                                                              • LocalAlloc.KERNEL32(00000040,00000000,?,?,00000000,DLS,00000000,?), ref: 6C0940D8
                                                                                                                              • GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 6C0940F2
                                                                                                                              • VerQueryValueA.VERSION(?,6C091534,?,?,?,?,?,00000000), ref: 6C094112
                                                                                                                              • LocalFree.KERNEL32(?,?,?,?,00000000), ref: 6C094139
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C094144
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C09415D
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: mmio$Close$DescendErrorFileInfoLastLocalVersion$AllocCompareFreeOpenQueryReadSizeStringValue_memset
                                                                                                                              • String ID: 4$DLS$DirectXSetupGetFileVersion$LocalAlloc()$LocalFree()$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c$mmioClose()$mmioDescend()$mmioRead()$vers
                                                                                                                              • API String ID: 2025664318-1787136798
                                                                                                                              • Opcode ID: ad5f2cff94fbc064b7ffb73c2d12a7b60a9141cfcdf549b480d3b656363e61de
                                                                                                                              • Instruction ID: 878bbe34becf47ca7adf7f2e4edbcff539f95b01938b6f7db4aede16eb3e14eb
                                                                                                                              • Opcode Fuzzy Hash: ad5f2cff94fbc064b7ffb73c2d12a7b60a9141cfcdf549b480d3b656363e61de
                                                                                                                              • Instruction Fuzzy Hash: 8D716DB1A00118BFEB119FE5CC44FAE7AFCAB09788F106429F615E3651DB30DA45AF60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0964D5 Relevance: 45.7, APIs: 6, Strings: 20, Instructions: 200windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __wstrtime.LIBCMT ref: 6C096506
                                                                                                                              • __wstrtime.LIBCMT ref: 6C09650F
                                                                                                                                • Part of subcall function 6C0963CE: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c), ref: 6C096404
                                                                                                                                • Part of subcall function 6C0963CE: OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.,00000000,e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c), ref: 6C096413
                                                                                                                                • Part of subcall function 6C094A54: _vswprintf_s.LIBCMT ref: 6C094A87
                                                                                                                                • Part of subcall function 6C0963CE: CreateDirectoryA.KERNEL32(?,00000000), ref: 6C096453
                                                                                                                                • Part of subcall function 6C0963CE: GetLastError.KERNEL32 ref: 6C09645D
                                                                                                                              • _strrchr.LIBCMT ref: 6C096555
                                                                                                                              • FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 6C096665
                                                                                                                              • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,GetRegistryDXVersion), ref: 6C09668A
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,GetRegistryDXVersion,e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c), ref: 6C096692
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectoryErrorLast__wstrtime$CreateDebugFormatFreeLocalMessageOutputStringWindows_strrchr_vswprintf_s
                                                                                                                              • String ID: $ Error:$ Failed API:%s$ File in process:$ - $ module: %s(%s), file: %s, line: %d, function: %s$%s(): %s$%s(): %s failed, error = %d.$%s(): %s failed, error = 0x%x.$%s(): %s failed.$(%d)$(0x%x)$--------------------$DSETUP$DXSError(): FormatMessage() failed, error = %d.$DXSError(): FormatMessage() failed, system cannot find message text for error.$GetRegistryDXVersion$Mar 30 2011$[%s %s]$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 3659207835-1158362067
                                                                                                                              • Opcode ID: 0f501c70bc55f415b2ec6a4485692b09746870e49ec5980f1e12f7f21f58516d
                                                                                                                              • Instruction ID: a40abbe702ff7651b35f0f99a88eeb0091c5796c66574fb6e724df7afb971d3f
                                                                                                                              • Opcode Fuzzy Hash: 0f501c70bc55f415b2ec6a4485692b09746870e49ec5980f1e12f7f21f58516d
                                                                                                                              • Instruction Fuzzy Hash: 4B61C371908218EBDF51ABA4CC49FDE77ECAB04208F407495F518E7A40DB35AA5CBBE0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69747F6A Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 210COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SetLastError.KERNEL32(0000000D), ref: 69747FAE
                                                                                                                              • SetLastError.KERNEL32(00000057,?,00000004,69741A1C), ref: 69748016
                                                                                                                              • FindResourceA.KERNEL32 ref: 69748061
                                                                                                                              • GetLastError.KERNEL32(Unable to find EULA %s.,?,?,?), ref: 69748076
                                                                                                                              • SizeofResource.KERNEL32(?,00000000,?,?), ref: 697480A7
                                                                                                                              • SetLastError.KERNEL32(0000007A,?,?), ref: 697480C4
                                                                                                                              • LoadResource.KERNEL32(?,00000000,?,?), ref: 697480E9
                                                                                                                              • GetLastError.KERNEL32(00000000,?,?), ref: 697480F4
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$Resource$FindLoadSizeof
                                                                                                                              • String ID: DATA$EULA text is invalid.$FindResource()$Insufficient buffer.$Invalid parameter - output buffer is NULL.$LoadResource()$LockResource()$MultiByteToWideChar()$SETUP_AGREEMENT_%s$Unable to find EULA %s.$Unable to find EULA for the specified language.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\eula.cpp$iDirectXSetupGetEULAW
                                                                                                                              • API String ID: 353423887-3345130644
                                                                                                                              • Opcode ID: cf61bdbdde3facb2773cee528582f4aa0013e88a24f93d6cd04d2f3e6350f0b3
                                                                                                                              • Instruction ID: bd93d63bc6a8cc4b06bc9c079c644c4f82c44cec8730fe8fb2336e7e231f37fb
                                                                                                                              • Opcode Fuzzy Hash: cf61bdbdde3facb2773cee528582f4aa0013e88a24f93d6cd04d2f3e6350f0b3
                                                                                                                              • Instruction Fuzzy Hash: 106192B594418DBFDB40BAA4CF45EEE7B78AB26F44F40443BF611A6053E6309A11CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69746391 Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 200windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __wstrtime.LIBCMT ref: 697463C2
                                                                                                                              • __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 6974625B: GetWindowsDirectoryA.KERNEL32(?,00000104,69747D8D,00000000), ref: 69746291
                                                                                                                                • Part of subcall function 6974625B: OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.,69747D8D,00000000), ref: 697462A0
                                                                                                                                • Part of subcall function 6974625B: CreateDirectoryA.KERNEL32(?,00000000), ref: 697462E0
                                                                                                                                • Part of subcall function 6974625B: GetLastError.KERNEL32 ref: 697462EA
                                                                                                                              • _strrchr.LIBCMT ref: 69746411
                                                                                                                              • FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 69746521
                                                                                                                              • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00066BDB), ref: 69746546
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00066BDB,00000000), ref: 6974654E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectoryErrorLast__wstrtime$CreateDebugFormatFreeLocalMessageOutputStringWindows_strrchr
                                                                                                                              • String ID: $ Error:$ Failed API:%s$ File in process:$ - $ module: %s(%s), file: %s, line: %d, function: %s$%s(): %s$%s(): %s failed, error = %d.$%s(): %s failed, error = 0x%x.$%s(): %s failed.$(%d)$(0x%x)$--------------------$DXSError(): FormatMessage() failed, error = %d.$DXSError(): FormatMessage() failed, system cannot find message text for error.$Mar 30 2011$[%s %s]$dsetup32
                                                                                                                              • API String ID: 3982051927-4052122332
                                                                                                                              • Opcode ID: 5af163193c26818e8585d4fcbebe847aa1115692465a7053e7e3c4fa203a501e
                                                                                                                              • Instruction ID: 2c03837ec6a8d2981e1219bd85c996376e1095a5deed22a921e4e57defa5ef89
                                                                                                                              • Opcode Fuzzy Hash: 5af163193c26818e8585d4fcbebe847aa1115692465a7053e7e3c4fa203a501e
                                                                                                                              • Instruction Fuzzy Hash: 3D61B575A00219FBDF21EBA8CF4CEEE7B6CAF55F44F0090A5B51896103DB309B548BA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A862B9 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 230windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetWindowLongA.USER32(?,000000EB), ref: 00A862E4
                                                                                                                              • GetParent.USER32(?), ref: 00A86394
                                                                                                                              • PostMessageA.USER32 ref: 00A8639B
                                                                                                                              • SetWindowLongA.USER32(?,000000EB,?), ref: 00A863B8
                                                                                                                              • GetDlgItem.USER32(?,00001389), ref: 00A863CF
                                                                                                                              • SendMessageA.USER32 ref: 00A863D6
                                                                                                                              • GetModuleHandleA.KERNEL32(00000000,00001F48,?,00000258), ref: 00A863FF
                                                                                                                              • LoadStringW.USER32(00000000), ref: 00A86406
                                                                                                                              • SetDlgItemTextW.USER32 ref: 00A8641E
                                                                                                                              • GetDlgItem.USER32(?,00001393), ref: 00A86436
                                                                                                                              • SendMessageA.USER32 ref: 00A8643D
                                                                                                                              • SendMessageA.USER32 ref: 00A86531
                                                                                                                              • GetParent.USER32(?), ref: 00A86586
                                                                                                                              • PostMessageA.USER32 ref: 00A8658D
                                                                                                                              • SetWindowLongA.USER32(?,00000000,00000001), ref: 00A8659E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$ItemLongSendWindow$ParentPost$HandleLoadModuleStringText
                                                                                                                              • String ID: CDXWSetup::InitInstall() failed.$CDXWSetup::Install() failed.$Invalid parameter - CDXWSetup is NULL.$ProgressDlgProc$Unable to initialize CDSetup.$WM_APP_ENDINSTALL$e:\bt\382730\setup\deliverables\dxsetup\psheets.cpp$start installation
                                                                                                                              • API String ID: 45273081-381161198
                                                                                                                              • Opcode ID: 50fdc6e456bf7acab5cb4461777ae1ec93feffb85b2559ba60110f3b79977db4
                                                                                                                              • Instruction ID: 9d90a26c166aa28909377bade45b6f2c1ff82aab2e3ca702538939855cc2dc88
                                                                                                                              • Opcode Fuzzy Hash: 50fdc6e456bf7acab5cb4461777ae1ec93feffb85b2559ba60110f3b79977db4
                                                                                                                              • Instruction Fuzzy Hash: 0871B7B1A40315BFEB24BFA0CD8AF6A767DEB04704F104659F706AA1D1CB749E81CB61
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974AC39 Relevance: 38.7, APIs: 10, Strings: 12, Instructions: 165registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion,00000000,00000001,?), ref: 6974AC6E
                                                                                                                              • RegQueryValueExA.ADVAPI32 ref: 6974ACC5
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6974ACF5
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$CloseOpenQueryValue_strrchr
                                                                                                                              • String ID: DXSETUPFOLDER path is too long, %s%s.$GetProgramFilesDir$GetShortPathName()$Insufficient buffer size.$ProgramFilesDir$RegCloseKey()$RegOpenKeyEx()$RegQueryValueEx()$Software\Microsoft\Windows\CurrentVersion$\directx\setup\$dwSize = %d, dwSizeData = %d$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h
                                                                                                                              • API String ID: 4010714187-3175587753
                                                                                                                              • Opcode ID: ad4c2691c4a9fcbe89c249e7c6a167294ef08450e697abb48895deda8c04af1f
                                                                                                                              • Instruction ID: 89585aaf10b652d656b0ca523adb65ea526389e890d2172387817aecd6d9c981
                                                                                                                              • Opcode Fuzzy Hash: ad4c2691c4a9fcbe89c249e7c6a167294ef08450e697abb48895deda8c04af1f
                                                                                                                              • Instruction Fuzzy Hash: FD51D771900128BBEB14AA608E4AFEF3B6DEB56F55F804075B505E5042EA706F918F61
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974D3B0 Relevance: 37.0, APIs: 6, Strings: 15, Instructions: 210registrystringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\DirectX,00000000,00000001,00000000), ref: 6974D406
                                                                                                                              • lstrcmpA.KERNEL32(?,Version), ref: 6974D425
                                                                                                                              • RegQueryValueExA.ADVAPI32 ref: 6974D45E
                                                                                                                              • lstrcmpA.KERNEL32(?,Version), ref: 6974D4BE
                                                                                                                              • RegQueryValueExA.ADVAPI32 ref: 6974D5FB
                                                                                                                                • Part of subcall function 69746872: _memset.LIBCMT ref: 69746882
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              • RegCloseKey.ADVAPI32(00000000), ref: 6974D690
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: QueryValue__wstrtimelstrcmp$CloseOpen_memset_strrchr
                                                                                                                              • String ID: CSetup::CheckVersion$CheckVersion(): ManagedDX have not been installed.$CheckVersion(): This is older DirectX which does not have the version value in the registry.$Checking the version: HKLM\software\microsoft\directx\%s$GetFileVersion() failed, unable to get version information of dsetup32.dll.$RC in registry = %02d, RC in DLL = %02d$RegCloseKey()$Software\Microsoft\DirectX$StringToVersionInfo() failed, version = %s.$Unable to create path string, %s%s.$Version$Version in DLL = %d.%02d.%02d.%04d$Version in registry = %s$dsetup32.dll$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 3543678321-2788586486
                                                                                                                              • Opcode ID: 1c975563a04dcbecac3fe16c62c82fcd0789f8197316cb3531334cc60372c53d
                                                                                                                              • Instruction ID: c2249e908009e3ea4f71663a7ea4a7a21f50492f068db6ddf7f5ec5f36eb0c2d
                                                                                                                              • Opcode Fuzzy Hash: 1c975563a04dcbecac3fe16c62c82fcd0789f8197316cb3531334cc60372c53d
                                                                                                                              • Instruction Fuzzy Hash: DB71CBB5A40618BEDB20DB54CE44FEF77BCAF05B05F4001AAB588E6142EB746F908F56
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8495A Relevance: 35.1, APIs: 9, Strings: 11, Instructions: 135windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _memset.LIBCMT ref: 00A84987
                                                                                                                              • GetCurrentDirectoryA.KERNEL32(00000104,00000000), ref: 00A8499C
                                                                                                                              • LoadStringW.USER32(000000D9,?,00000104), ref: 00A84A2A
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 00A84A35
                                                                                                                              • ___swprintf_l.LIBCMT ref: 00A84A75
                                                                                                                              • LoadStringW.USER32(00000064,?,00000104), ref: 00A84A8D
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 00A84A98
                                                                                                                              • MessageBoxW.USER32 ref: 00A84ADB
                                                                                                                                • Part of subcall function 00A844B1: FindFirstFileA.KERNELBASE(?,?), ref: 00A84554
                                                                                                                                • Part of subcall function 00A844B1: FindClose.KERNEL32(00000000), ref: 00A84560
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 00A84AE5
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$FindLoadString$CloseCurrentDirectoryFileFirstMessage___swprintf_l_memset
                                                                                                                              • String ID: DirectX Setup$GetCurrentDirectory()$LoadString()$LogNoDsetup$Unable to find %s$Unable to find %s.$\dsetup.dll$\dsetup32.dll$dsetup.dll$dsetup32.dll$e:\bt\382730\setup\deliverables\dxsetup\dxsetup.cpp
                                                                                                                              • API String ID: 525178981-2515890001
                                                                                                                              • Opcode ID: 2384a0752820aaf6ca806b6eac0b342b330453eb0cd2e58798062b19f166bf39
                                                                                                                              • Instruction ID: 6c4882ff219be1f727503c1b2fb71ebcf5d72082825eaa4384fb1bf4d3624b9d
                                                                                                                              • Opcode Fuzzy Hash: 2384a0752820aaf6ca806b6eac0b342b330453eb0cd2e58798062b19f166bf39
                                                                                                                              • Instruction Fuzzy Hash: 1A41A3B6E412187BDB11F7E0DD4AEEF7BACEB58B40F400465F505E1081EA74DB168B60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974DAF0 Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 164COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: .cat$.chm$.hlp$.inf$CabCallback$FILEINCABINET: Unknown context...$SPFILENOTIFY_FILEINCABINET: GET_DISK_SPACE: Unable to allocate memory.$bdasetup.inf$directX.inf$dxbda.inf$dxnt.inf$dxntunp.inf$dxver.inf$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp$jystk$kssetup.inf
                                                                                                                              • API String ID: 0-2698226022
                                                                                                                              • Opcode ID: 57095a953b74229e462f49a78155bc3e73f1e32804e5f63ebabb47aeeda367f4
                                                                                                                              • Instruction ID: 058cf441fb6d4a8a4125e44abe7c71619e340a0e06254ed24f6dd724a4914676
                                                                                                                              • Opcode Fuzzy Hash: 57095a953b74229e462f49a78155bc3e73f1e32804e5f63ebabb47aeeda367f4
                                                                                                                              • Instruction Fuzzy Hash: 4351F3B4684515EFDB118E24CF89F6A37A4FF02F58F004866E950EF0A7FB61E900DA45
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974BA84 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 146fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 6974BADC
                                                                                                                              • GetLastError.KERNEL32(Unable to open file, %s.,?,?,80000000,00000003,00000000,00000003,00000080,00000000,?,00000000), ref: 6974BAF0
                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000,?,?,80000000,00000003,00000000,00000003,00000080,00000000,?,00000000), ref: 6974BB0B
                                                                                                                              • GetLastError.KERNEL32(00000000,?,?,80000000,00000003,00000000,00000003,00000080,00000000,?,00000000), ref: 6974BB1C
                                                                                                                              • _memset.LIBCMT ref: 6974BB6D
                                                                                                                              • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 6974BB7F
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6974BBC1
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 6974BBE8
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6974BBF3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$File$CloseCreateHandleReadSize_memset
                                                                                                                              • String ID: CheckSum$CloseHandle()$CreateFile()$GetFileSize()$ReadFile()$Unable to allocate buffer.$Unable to find file, %s.$Unable to open file, %s.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 197260801-1870010058
                                                                                                                              • Opcode ID: d49709bef732b6fca1e60994df19dc7985199ce3dc08ecd25af10b665b8e8054
                                                                                                                              • Instruction ID: a01d468d034b946d7c9ac841a1439cfcbe2b616080b968e9151d2e2653be899b
                                                                                                                              • Opcode Fuzzy Hash: d49709bef732b6fca1e60994df19dc7985199ce3dc08ecd25af10b665b8e8054
                                                                                                                              • Instruction Fuzzy Hash: C941D471E802487BDB00AAA58F89DAF7B7CEB56F55F504126F904F2143E7306E018A60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974CC6F Relevance: 29.9, APIs: 5, Strings: 12, Instructions: 187fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CharLower$CopyErrorFileLast_strrchr
                                                                                                                              • String ID: CSetup::DoBackup$CopyFile()$Unable to allocate memory block.$Unable to copy %s.$Unable to create path string, %s%s%s.$drivers$dxxpdbg$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp$help$inf$sysbckup$system
                                                                                                                              • API String ID: 864436029-3807277504
                                                                                                                              • Opcode ID: 7a54b76358610233b60008b9c0ed88ccbafbd44c3d148b9e6d9a267a8997d45f
                                                                                                                              • Instruction ID: 17d6857f14ffbfe692599554fd51ee1b0d0eade688d81d00b4808101232d525e
                                                                                                                              • Opcode Fuzzy Hash: 7a54b76358610233b60008b9c0ed88ccbafbd44c3d148b9e6d9a267a8997d45f
                                                                                                                              • Instruction Fuzzy Hash: E651D0B6944219AEDF10DBA0CE45ECA77BCAF45B14F1440B6A544E7082FF31AB858B64
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6975A8C8 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadLibraryA.KERNEL32(USER32.DLL), ref: 6975A8F7
                                                                                                                              • GetProcAddress.KERNEL32(00000000,MessageBoxA,?,?,?,?,69757C3B,6975EE68,Microsoft Visual C++ Runtime Library,00012010), ref: 6975A916
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000,?,?,?,?,69757C3B,6975EE68,Microsoft Visual C++ Runtime Library,00012010), ref: 6975A92F
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000,?,?,?,?,69757C3B,6975EE68,Microsoft Visual C++ Runtime Library,00012010), ref: 6975A944
                                                                                                                              • __get_wpgmptr.LIBCMT ref: 6975A955
                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA,?,?,?,?,69757C3B,6975EE68), ref: 6975A979
                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetProcessWindowStation,?,?,?,?,69757C3B,6975EE68), ref: 6975A991
                                                                                                                              • __get_amblksiz.LIBCMT ref: 6975A9E9
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$LibraryLoad__get_amblksiz__get_wpgmptr
                                                                                                                              • String ID: ;|uihui$;|uihui$GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL$hui
                                                                                                                              • API String ID: 2538533512-4087768784
                                                                                                                              • Opcode ID: e92dc387b5f753202146555ac5ef7d75b506d89e515accabca0bfac5d7348102
                                                                                                                              • Instruction ID: b7af7edbaf8f54de31cb95bc57add1092378e91879b56cadda95354426674e2c
                                                                                                                              • Opcode Fuzzy Hash: e92dc387b5f753202146555ac5ef7d75b506d89e515accabca0bfac5d7348102
                                                                                                                              • Instruction Fuzzy Hash: C8415176D04254EADFC4EFF5DF89A6E7B78BB05628F10843AE416E6040DF34CA60DA61
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974741B Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 144COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetDesktopWindow.USER32 ref: 69747434
                                                                                                                              • GetWindowRect.USER32(?,?), ref: 69747448
                                                                                                                              • GetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,69747CC1), ref: 6974744F
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              • GetWindowRect.USER32(?,?), ref: 69747490
                                                                                                                              • GetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,69747CC1), ref: 69747497
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Window$ErrorLastRect__wstrtime$Desktop_strrchr
                                                                                                                              • String ID: CenterWindow$GetDC()$GetWindowRect()$SetWindowPos()$e:\bt\382730\setup\deliverables\dsetup\dsetup32\eula.cpp
                                                                                                                              • API String ID: 974696245-2165572117
                                                                                                                              • Opcode ID: c826427366e6b436e2bc324f5eec2335426cc5d4d1b35cc3f3c5e10d7da21e7b
                                                                                                                              • Instruction ID: c28b751c83bcef6d24cca061cee4359371c0527acf06922605a012c63410c1ba
                                                                                                                              • Opcode Fuzzy Hash: c826427366e6b436e2bc324f5eec2335426cc5d4d1b35cc3f3c5e10d7da21e7b
                                                                                                                              • Instruction Fuzzy Hash: A6418871F40149AFCB00EBF8CE49CEEBBB5AB59B41F544525F501F7142EB309A118B60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974A5D2 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 135registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetFileAttributesA.KERNEL32(?), ref: 6974A601
                                                                                                                              • GetLastError.KERNEL32 ref: 6974A616
                                                                                                                              • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6974A661
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6974A66C
                                                                                                                              • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000002,?), ref: 6974A6DA
                                                                                                                              • _strnlen.LIBCMT ref: 6974A6EC
                                                                                                                              • RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 6974A70D
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6974A739
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                                • Part of subcall function 69746391: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 69746521
                                                                                                                                • Part of subcall function 69746391: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00066BDB), ref: 69746546
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast__wstrtime$AttributesCloseDirectoryFileFormatFreeLocalMessageOpenSystemValue_strnlen_strrchr
                                                                                                                              • String ID: Command line is too long.$DXRemoveFileAtReboot$GetFileAttributes() returned -1, reason = %d.$GetSystemDirectory()$RegOpenKeyEx()$RegSetValueEx()$Software\Microsoft\Windows\CurrentVersion\RunOnce$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h$rundll32.exe %s\advpack.dll,DelNodeRunDLL32 "%s\"
                                                                                                                              • API String ID: 4261019213-1120788408
                                                                                                                              • Opcode ID: abfa535a295bc90c1331990bac7984529fdf38d4dce264435371a2d13cd0acd8
                                                                                                                              • Instruction ID: 96813577e439ea21c725bef29d46263d4573657fe82e0a6f4fb524e89682de49
                                                                                                                              • Opcode Fuzzy Hash: abfa535a295bc90c1331990bac7984529fdf38d4dce264435371a2d13cd0acd8
                                                                                                                              • Instruction Fuzzy Hash: F441F471980248BBEB21AA608E49FAF377CFB56F14F404075F604E9082EB715F508F25
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69749D7D Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 129windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetDlgItem.USER32(?,00001771), ref: 69749DF6
                                                                                                                              • SendMessageA.USER32 ref: 69749E12
                                                                                                                              • SendMessageA.USER32 ref: 69749E23
                                                                                                                              • SendMessageA.USER32 ref: 69749E34
                                                                                                                              • ShowWindow.USER32(?,00000001), ref: 69749E3E
                                                                                                                              • GetDlgItem.USER32(?,00001770), ref: 69749E5E
                                                                                                                              • SendMessageA.USER32 ref: 69749E65
                                                                                                                              • SetDlgItemTextA.USER32(?,00000FA2,?), ref: 69749E95
                                                                                                                              • GetLastError.KERNEL32(Not fatal...), ref: 69749EA4
                                                                                                                              • SetDlgItemTextA.USER32(?,00000FA3,69742B57), ref: 69749ED4
                                                                                                                              • GetLastError.KERNEL32(Not fatal...), ref: 69749EE3
                                                                                                                              • GetDlgItem.USER32(?,00001771), ref: 69749F2A
                                                                                                                              • SendMessageA.USER32 ref: 69749F31
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ItemMessageSend$ErrorLastText$ShowWindow
                                                                                                                              • String ID: CSetup::UpdateProgress2$Not fatal...$SetDlgItemText()$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 3384336025-30365464
                                                                                                                              • Opcode ID: 3dbaa78a89bc7c99f1a599c91e4f1ed318e579e9b2078a6f9811859c5dd4a9e4
                                                                                                                              • Instruction ID: 9021d38499b1ceeac969e98ec834fe7baff8d49cd44809baac21b9a83718ad7f
                                                                                                                              • Opcode Fuzzy Hash: 3dbaa78a89bc7c99f1a599c91e4f1ed318e579e9b2078a6f9811859c5dd4a9e4
                                                                                                                              • Instruction Fuzzy Hash: 5241C131744205BBEF20AB64CF8AFAA7768BB11F04F504076F604E9082E7B19961DB10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A85627 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 122windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              • e:\bt\382730\setup\deliverables\dxsetup\psheets.cpp, xrefs: 00A856D0
                                                                                                                              • N, xrefs: 00A8563B
                                                                                                                              • PreinstDlgProc, xrefs: 00A856C6
                                                                                                                              • Unable to initialize CDXWSetup., xrefs: 00A856BF
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$LongParentPostWindow$ItemSend
                                                                                                                              • String ID: N$PreinstDlgProc$Unable to initialize CDXWSetup.$e:\bt\382730\setup\deliverables\dxsetup\psheets.cpp
                                                                                                                              • API String ID: 1491212057-701473252
                                                                                                                              • Opcode ID: 50018007f91b0a69e81503a66ba35ae3d8f02f3c3d721ebd3085ded86cb414f7
                                                                                                                              • Instruction ID: 8521d5219c3e1ec4969f815b2a2b3a131f9f375cc653f3a2566078470d4325fc
                                                                                                                              • Opcode Fuzzy Hash: 50018007f91b0a69e81503a66ba35ae3d8f02f3c3d721ebd3085ded86cb414f7
                                                                                                                              • Instruction Fuzzy Hash: 1231C571A90704BBEB20BBB58C8EF5B3BACDB84B54F114915F705AA0D1E6B0DD42CB60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0A0D95 Relevance: 28.9, APIs: 19, Instructions: 391COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LCMapStringW.KERNEL32(00000000,00000100,6C09363C,00000001,00000000,00000000,6C0A2A58,0000002C,6C0A1282,00004000,00000000,00004000,?,?,?,?), ref: 6C0A0DBF
                                                                                                                              • GetLastError.KERNEL32(?,6C09C6F1,6C09225F,UTF-8,00000000,?,00000000,6C0A51A8), ref: 6C0A0DD1
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,6C0A2A58,0000002C,6C0A1282,00004000,00000000,00004000,?,?,?,?), ref: 6C0A0E60
                                                                                                                              • __alloca_probe_16.LIBCMT ref: 6C0A0E93
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 6C0A0F14
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastString__alloca_probe_16
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1172796519-0
                                                                                                                              • Opcode ID: 42bb95bd669b2322e4a2b5b5784a3323fc3506047a7f46aff7616c9c19b0f0f8
                                                                                                                              • Instruction ID: 496dd81f20d6b7d1007cde4263480fc8dcc2a4fb8bbd43253ab6976b3d7e2605
                                                                                                                              • Opcode Fuzzy Hash: 42bb95bd669b2322e4a2b5b5784a3323fc3506047a7f46aff7616c9c19b0f0f8
                                                                                                                              • Instruction Fuzzy Hash: D2D19871904258EFDF008FE5CC84BDE7AF6FB09718F20412AF915A6A52C771D892EB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974BD44 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 216timeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • SystemTimeToFileTime.KERNEL32(?,?), ref: 6974BEAC
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6974BEB7
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Time$ErrorFileLastSystem
                                                                                                                              • String ID: /-:.$CSetup::CheckForceCopyTimeStamp$File timestamp %02d/%02d/%d-%02d:%02d:%02d.%02d is older than %02d/%02d/%d-%02d:%02d:%02d.%02d.$FileTimeToSystemTime()$LocalFileTimeToFileTime()$SystemTimeToFileTime()$SystemTimeToTzSpecificLocalTime()$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 2781989572-3991514089
                                                                                                                              • Opcode ID: 343139c3053db3c55228f38e7be6bf6cb0cd0b330e6e67a9759f4909b861a8af
                                                                                                                              • Instruction ID: df54ebdf0facab60b3584eb6cfb623205d675676df818056f18fe4a59690f201
                                                                                                                              • Opcode Fuzzy Hash: 343139c3053db3c55228f38e7be6bf6cb0cd0b330e6e67a9759f4909b861a8af
                                                                                                                              • Instruction Fuzzy Hash: F9718275D00118AADB61DBA58E48EFE77BCAF19B04F004496F54CE1002EB35AF909FA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A847AF Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 126windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadStringW.USER32(00000064,?,00000104), ref: 00A847F5
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 00A8480C
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              • LoadStringW.USER32(?,?,00000104), ref: 00A84858
                                                                                                                              • GetLastError.KERNEL32(String ID: %d,?), ref: 00A8486A
                                                                                                                              • LoadStringW.USER32(0000006F,?,00000104), ref: 00A848A6
                                                                                                                              • GetLastError.KERNEL32(String ID: %d,0000006F), ref: 00A848B7
                                                                                                                              • LoadStringW.USER32(00000082,?,00000104), ref: 00A848E1
                                                                                                                              • GetLastError.KERNEL32(String ID: %d,00000082), ref: 00A848F5
                                                                                                                              • ___swprintf_l.LIBCMT ref: 00A8491E
                                                                                                                              • MessageBoxW.USER32 ref: 00A84940
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastLoadString$__wstrtime$Message___swprintf_l_strrchr
                                                                                                                              • String ID: DirectX Setup$LoadString()$MsgBox$String ID: %d$e:\bt\382730\setup\deliverables\dxsetup\dxsetup.cpp$o
                                                                                                                              • API String ID: 3419616289-3620252275
                                                                                                                              • Opcode ID: 57cf41918bbe8416872e0a66bd28a9d03b4e1bf6d9aa1f47523c030158a7c8a7
                                                                                                                              • Instruction ID: 95ee347d75bdf880b12c7896dc2eca87b61488813852d7c42836b007f5a94c6b
                                                                                                                              • Opcode Fuzzy Hash: 57cf41918bbe8416872e0a66bd28a9d03b4e1bf6d9aa1f47523c030158a7c8a7
                                                                                                                              • Instruction Fuzzy Hash: 4E41EAB6B40219BBDB20FFA4DC46FEB7BACEB48740F004575F605E1091E6718E528B60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8E007 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadLibraryA.KERNEL32(USER32.DLL), ref: 00A8E036
                                                                                                                              • GetProcAddress.KERNEL32(00000000,MessageBoxA,?,?,?,?,00A88325,00A99768,Microsoft Visual C++ Runtime Library,00012010), ref: 00A8E055
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000,?,?,?,?,00A88325,00A99768,Microsoft Visual C++ Runtime Library,00012010), ref: 00A8E06E
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000,?,?,?,?,00A88325,00A99768,Microsoft Visual C++ Runtime Library,00012010), ref: 00A8E083
                                                                                                                              • __get_wpgmptr.LIBCMT ref: 00A8E094
                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA,?,?,?,?,00A88325,00A99768), ref: 00A8E0B8
                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetProcessWindowStation,?,?,?,?,00A88325,00A99768), ref: 00A8E0D0
                                                                                                                              • __get_amblksiz.LIBCMT ref: 00A8E128
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$LibraryLoad__get_amblksiz__get_wpgmptr
                                                                                                                              • String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
                                                                                                                              • API String ID: 2538533512-232180764
                                                                                                                              • Opcode ID: 2e68e1c664982333944a28bf273cc988f0a444de2b259c45ba3fa19ce0b61ed9
                                                                                                                              • Instruction ID: bd93832e2256dc35964a1b233fcac958ffda732e86d366853ee2cdb619a63e3c
                                                                                                                              • Opcode Fuzzy Hash: 2e68e1c664982333944a28bf273cc988f0a444de2b259c45ba3fa19ce0b61ed9
                                                                                                                              • Instruction Fuzzy Hash: ED41A3B1E40215EEDF20FFF59E8A96EBBB8AF64300B50092BF504D2151DF79C9418BA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0A03E0 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadLibraryA.KERNEL32(USER32.DLL), ref: 6C0A040F
                                                                                                                              • GetProcAddress.KERNEL32(00000000,MessageBoxA,?,?,?,?,6C09CB75,6C0A59B8,Microsoft Visual C++ Runtime Library,00012010), ref: 6C0A042E
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000,?,?,?,?,6C09CB75,6C0A59B8,Microsoft Visual C++ Runtime Library,00012010), ref: 6C0A0447
                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000,?,?,?,?,6C09CB75,6C0A59B8,Microsoft Visual C++ Runtime Library,00012010), ref: 6C0A045C
                                                                                                                              • __get_wpgmptr.LIBCMT ref: 6C0A046D
                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA,?,?,?,?,6C09CB75,6C0A59B8), ref: 6C0A0491
                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetProcessWindowStation,?,?,?,?,6C09CB75,6C0A59B8), ref: 6C0A04A9
                                                                                                                              • __get_amblksiz.LIBCMT ref: 6C0A0501
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$LibraryLoad__get_amblksiz__get_wpgmptr
                                                                                                                              • String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
                                                                                                                              • API String ID: 2538533512-232180764
                                                                                                                              • Opcode ID: f081b28acb3a446224aaf0b9d5304dec2f6f11c922a40645efcd3a1152f975bc
                                                                                                                              • Instruction ID: b7b9c2263d27340ac4991a778d94e475edebb51397562714d31b605c806437b0
                                                                                                                              • Opcode Fuzzy Hash: f081b28acb3a446224aaf0b9d5304dec2f6f11c922a40645efcd3a1152f975bc
                                                                                                                              • Instruction Fuzzy Hash: 4A41D4B2D05648ABDF10DFF89C88BAE7AF8BF4531CF60082AE411E7941DB34D245DA61
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6975166A Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 112libraryloadermemoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,6974F2F1), ref: 69751672
                                                                                                                              • __mtterm.LIBCMT ref: 6975167E
                                                                                                                                • Part of subcall function 6975130C: TlsFree.KERNEL32(00000019,6974F385), ref: 69751337
                                                                                                                                • Part of subcall function 6975130C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6974F385), ref: 69754901
                                                                                                                                • Part of subcall function 6975130C: DeleteCriticalSection.KERNEL32(00000019,?,?,6974F385), ref: 6975492B
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsAlloc,?,?,6974F2F1), ref: 69751694
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsGetValue,?,6974F2F1), ref: 697516A1
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsSetValue,?,6974F2F1), ref: 697516AE
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsFree,?,6974F2F1), ref: 697516BB
                                                                                                                              • TlsAlloc.KERNEL32(?,6974F2F1), ref: 6975170B
                                                                                                                              • TlsSetValue.KERNEL32(00000000,?,6974F2F1), ref: 69751722
                                                                                                                              • __mtterm.LIBCMT ref: 69751779
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$CriticalDeleteSection__mtterm$AllocFreeHandleModuleValue
                                                                                                                              • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                                                                                                                              • API String ID: 1270926730-3819984048
                                                                                                                              • Opcode ID: 15bdf9bafcc0a1376b1e4a88c2f9a37880133bc4074f27899aeb7f84662f1dde
                                                                                                                              • Instruction ID: cc22932b42f3f2f1ec64eabd505a9bc4c7f46fef9442e37f3652cf93b9cec622
                                                                                                                              • Opcode Fuzzy Hash: 15bdf9bafcc0a1376b1e4a88c2f9a37880133bc4074f27899aeb7f84662f1dde
                                                                                                                              • Instruction Fuzzy Hash: AE318235904295FAEFC0AFB4AA486253BE4EF46756B00993AE412D31A0EF31E4A09F54
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A890B0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 112libraryloadermemoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00A86F8C), ref: 00A890B8
                                                                                                                              • __mtterm.LIBCMT ref: 00A890C4
                                                                                                                                • Part of subcall function 00A88DC5: TlsFree.KERNEL32(0000000A,00A891C4), ref: 00A88DF0
                                                                                                                                • Part of subcall function 00A88DC5: DeleteCriticalSection.KERNEL32(00000000,00000000,756F14CB,00000001,00A891C4), ref: 00A8DA3E
                                                                                                                                • Part of subcall function 00A88DC5: DeleteCriticalSection.KERNEL32(0000000A,756F14CB,00000001,00A891C4), ref: 00A8DA68
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsAlloc,?), ref: 00A890DA
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00A890E7
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00A890F4
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00A89101
                                                                                                                              • TlsAlloc.KERNEL32 ref: 00A89151
                                                                                                                              • TlsSetValue.KERNEL32(00000000), ref: 00A89168
                                                                                                                              • __mtterm.LIBCMT ref: 00A891BF
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$CriticalDeleteSection__mtterm$AllocFreeHandleModuleValue
                                                                                                                              • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                                                                                                                              • API String ID: 1270926730-3819984048
                                                                                                                              • Opcode ID: 31331e927a2341d6bfc49ce3a1e042f8e97ee1bc76a65bdd5e431e492acdf943
                                                                                                                              • Instruction ID: fdc0fd8dacbe93550ed0a09fe125c583c189c7bd447e180db076d17deff2340e
                                                                                                                              • Opcode Fuzzy Hash: 31331e927a2341d6bfc49ce3a1e042f8e97ee1bc76a65bdd5e431e492acdf943
                                                                                                                              • Instruction Fuzzy Hash: E9316F75A54311BADB10FBF9BD0E6273AA5AB49768B14062FE418922E0EF7D8443CB50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C097E93 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 112libraryloadermemoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,6C09684A), ref: 6C097E9B
                                                                                                                              • __mtterm.LIBCMT ref: 6C097EA7
                                                                                                                                • Part of subcall function 6C097B35: TlsFree.KERNEL32(0000000C,6C0968DE), ref: 6C097B60
                                                                                                                                • Part of subcall function 6C097B35: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6C0968DE), ref: 6C09ACB6
                                                                                                                                • Part of subcall function 6C097B35: DeleteCriticalSection.KERNEL32(0000000C,?,?,6C0968DE), ref: 6C09ACE0
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsAlloc,?,?,6C09684A), ref: 6C097EBD
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsGetValue,?,6C09684A), ref: 6C097ECA
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsSetValue,?,6C09684A), ref: 6C097ED7
                                                                                                                              • GetProcAddress.KERNEL32(00000000,FlsFree,?,6C09684A), ref: 6C097EE4
                                                                                                                              • TlsAlloc.KERNEL32(?,6C09684A), ref: 6C097F34
                                                                                                                              • TlsSetValue.KERNEL32(00000000,?,6C09684A), ref: 6C097F4B
                                                                                                                              • __mtterm.LIBCMT ref: 6C097FA2
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$CriticalDeleteSection__mtterm$AllocFreeHandleModuleValue
                                                                                                                              • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                                                                                                                              • API String ID: 1270926730-3819984048
                                                                                                                              • Opcode ID: ccf0e35e37395da51bd0d549afa1a774dc8e1fdc55209aa44f2c684da64de535
                                                                                                                              • Instruction ID: b87841d3205cdf1511337d584df74ab3f3b88f33023ae7397364485aeb2c46ec
                                                                                                                              • Opcode Fuzzy Hash: ccf0e35e37395da51bd0d549afa1a774dc8e1fdc55209aa44f2c684da64de535
                                                                                                                              • Instruction Fuzzy Hash: 2E319636719E109EDF019FBDAC04B4D7AF4BB8631DB50AA35D024D3692EF309180FAA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C093D6D Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 105windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 6C093D1D: PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 6C093D5E
                                                                                                                              • SetFocus.USER32 ref: 6C093DCF
                                                                                                                              • GetLastError.KERNEL32(Not fatal...), ref: 6C093DDE
                                                                                                                              • CreateDialogParamA.USER32(00000064,6C093D13,00000000), ref: 6C093E42
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C093E52
                                                                                                                              • SetDlgItemTextA.USER32(00000000,00000FA1,?), ref: 6C093E71
                                                                                                                              • GetLastError.KERNEL32(Not fatal...), ref: 6C093E80
                                                                                                                              • DirectXLoadString.DSETUP32(000003E8,?,00000104), ref: 6C093EAC
                                                                                                                              • MessageBoxA.USER32 ref: 6C093EC3
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$Message$CreateDialogDirectFocusItemLoadParamPeekStringText
                                                                                                                              • String ID: CreateDialog()$DirectXSetupCallback$Not fatal...$SetDlgItemText()$SetFocus()$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 371606451-1383702628
                                                                                                                              • Opcode ID: bf624d3d237277f8ea338b7b9cdb7f40da7ab0f17278528360f7a528832488df
                                                                                                                              • Instruction ID: eb9a0c8e1adf4ca80c0177129020b200da2131cc00945dcf319dbfa384f32b25
                                                                                                                              • Opcode Fuzzy Hash: bf624d3d237277f8ea338b7b9cdb7f40da7ab0f17278528360f7a528832488df
                                                                                                                              • Instruction Fuzzy Hash: 3B31AF38705605BBEF005EA6DC45F9E3BFCBB0A709B046025B60ED6991DF70D940AF90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974767D Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 99COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FindResourceA.KERNEL32 ref: 69747693
                                                                                                                              • GetLastError.KERNEL32(Unable to find EULA %s.,69747D8D,?,?,697477A6,SETUP_AGREEMENT_ENG,000012F1,00066BDB,69747D8D), ref: 697476A5
                                                                                                                              • LoadResource.KERNEL32(?,00000000,?,?,697477A6,SETUP_AGREEMENT_ENG,000012F1,00066BDB,69747D8D), ref: 697476D5
                                                                                                                              • GetLastError.KERNEL32(Unable to load EULA %s.,69747D8D,?,?,697477A6,SETUP_AGREEMENT_ENG,000012F1,00066BDB,69747D8D), ref: 697476EA
                                                                                                                              • _memset.LIBCMT ref: 6974772D
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastResource$FindLoad_memset
                                                                                                                              • String ID: CheckCheckSum$DATA$EULA %s damaged.$FindResource()$LoadResource()$Unable to allocate memory block for EULA %s$Unable to find EULA %s.$Unable to load EULA %s.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\eula.cpp
                                                                                                                              • API String ID: 3094993533-3028198498
                                                                                                                              • Opcode ID: ffe72cc3138b7e0586a1b327ace52ed0611368120a8217f158ab947c90e4709d
                                                                                                                              • Instruction ID: 8b00a5d2a9d1c81f051cc0e942a817c2accae84f9036a2942a8b5f8a3363a8f5
                                                                                                                              • Opcode Fuzzy Hash: ffe72cc3138b7e0586a1b327ace52ed0611368120a8217f158ab947c90e4709d
                                                                                                                              • Instruction Fuzzy Hash: 7521F736684649BFD702BFA4CF45E9F3AA9EB65F85F818421F904E6013F620DB308661
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0963CE Relevance: 24.6, APIs: 4, Strings: 10, Instructions: 80COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c), ref: 6C096404
                                                                                                                              • OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.,00000000,e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c), ref: 6C096413
                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 6C096453
                                                                                                                              • GetLastError.KERNEL32 ref: 6C09645D
                                                                                                                              Strings
                                                                                                                              • DXSETUP_DPF(): Unable to open log file., xrefs: 6C0964A8
                                                                                                                              • --------------------, xrefs: 6C0964B3
                                                                                                                              • \Logs, xrefs: 6C09641E
                                                                                                                              • %s%s%s, xrefs: 6C096482
                                                                                                                              • DXSETUP_DPF(): GetWindowsDirectory() failed., xrefs: 6C09640E
                                                                                                                              • Logs\DXError.log, xrefs: 6C096471
                                                                                                                              • %s%s, xrefs: 6C09642A
                                                                                                                              • DXSETUP_DPF(): failed to create log directory., xrefs: 6C09646A
                                                                                                                              • DXSETUP_DPF(): path name too long., xrefs: 6C096443
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c, xrefs: 6C0963EA
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Directory$CreateDebugErrorLastOutputStringWindows
                                                                                                                              • String ID: %s%s$%s%s%s$--------------------$DXSETUP_DPF(): GetWindowsDirectory() failed.$DXSETUP_DPF(): Unable to open log file.$DXSETUP_DPF(): failed to create log directory.$DXSETUP_DPF(): path name too long.$Logs\DXError.log$\Logs$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 3967814497-2516916496
                                                                                                                              • Opcode ID: 03ac1492d304c87fe13a60a59536652290a5b755c51c9565b853c5583bd09160
                                                                                                                              • Instruction ID: 92f77d22905e8de9f8860a37200cacf691fa450b27ee84b761a519eb6e82dfbb
                                                                                                                              • Opcode Fuzzy Hash: 03ac1492d304c87fe13a60a59536652290a5b755c51c9565b853c5583bd09160
                                                                                                                              • Instruction Fuzzy Hash: A5210571A09114B7D7619AE69C08FCF37FCAB42704F407461F548E2941EF20DA88BAE2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697493DF Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 77libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 6974940C
                                                                                                                              • LoadLibraryA.KERNEL32(advpack.dll), ref: 69749448
                                                                                                                              • GetProcAddress.KERNEL32(00000000,IsNTAdmin), ref: 6974945C
                                                                                                                              • GetLastError.KERNEL32(Module: %s, Function: %s,advpack.dll,IsNTAdmin), ref: 69749487
                                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 697494A8
                                                                                                                              • GetLastError.KERNEL32(Unable to load %s.,advpack.dll), ref: 697494B7
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastLibrary$AddressFreeLoadProcVersion
                                                                                                                              • String ID: GetProcAddress()$IsAdmin$IsNTAdmin$LoadLibrary()$Module: %s, Function: %s$Unable to load %s.$advpack.dll$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 3600083760-2055996021
                                                                                                                              • Opcode ID: 3ebef95a20306c3b7f846acb32c542aedf2691d31c1877076c004cfabf19cd12
                                                                                                                              • Instruction ID: 1fb63136cdbf95a32316e5024be48f72d1c4d671a97fc3f39e70d4a6471112da
                                                                                                                              • Opcode Fuzzy Hash: 3ebef95a20306c3b7f846acb32c542aedf2691d31c1877076c004cfabf19cd12
                                                                                                                              • Instruction Fuzzy Hash: 5F21C130950154EBEB60ABB5CF89FAE77B8ABA6F15F4040A5E109E1043DB705AA4CF71
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C095E51 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 77libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 6C095E7E
                                                                                                                              • LoadLibraryA.KERNEL32(advpack.dll), ref: 6C095EBA
                                                                                                                              • GetProcAddress.KERNEL32(00000000,IsNTAdmin), ref: 6C095ECE
                                                                                                                              • GetLastError.KERNEL32(Module: %s, Function: %s,advpack.dll,IsNTAdmin), ref: 6C095EF9
                                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 6C095F1A
                                                                                                                              • GetLastError.KERNEL32(Unable to load %s.,advpack.dll), ref: 6C095F29
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastLibrary$AddressFreeLoadProcVersion
                                                                                                                              • String ID: GetProcAddress()$IsAdmin$IsNTAdmin$LoadLibrary()$Module: %s, Function: %s$Unable to load %s.$advpack.dll$e:\temp\382730\obj.x86fre\setup\deliverables\dsetup\dsetup\win9x\objfre\i386\dsinline.c
                                                                                                                              • API String ID: 3600083760-4189720054
                                                                                                                              • Opcode ID: 128061f9961d7e664a062a1ea6126165ab7ab308f2000b82084e149c6ec407c1
                                                                                                                              • Instruction ID: b042c944461577677ccc1d5b970729e158147c06231ea22a5ff15ddf83941502
                                                                                                                              • Opcode Fuzzy Hash: 128061f9961d7e664a062a1ea6126165ab7ab308f2000b82084e149c6ec407c1
                                                                                                                              • Instruction Fuzzy Hash: 04210334A15124FBEB209FB68C4DFAA72FCEB15716F402195B20DE1981CF309988EF60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69756005 Relevance: 24.4, APIs: 16, Instructions: 391COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LCMapStringW.KERNEL32(00000000,00000100,69744E80,00000001,00000000,00000000,6975B668,0000002C,697564F2,00004000,00000000,00004000,?,?,?,?), ref: 6975602F
                                                                                                                              • GetLastError.KERNEL32(?,69753C56,69741317,UTF-8,69747D8D,69741318,00000000,6975E4A8), ref: 69756041
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,6975B668,0000002C,697564F2,00004000,00000000,00004000,?,?,?,?), ref: 697560D0
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 69756184
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastString
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2717499641-0
                                                                                                                              • Opcode ID: 1b03c6b6e4936624810d328e63f92952e4d0ad10849178aa63a00ffc1dee7e05
                                                                                                                              • Instruction ID: 4b10c3d35a887d9bc0a4f5ba342d1c0030ecf579018cea0125de4c8c676e67c1
                                                                                                                              • Opcode Fuzzy Hash: 1b03c6b6e4936624810d328e63f92952e4d0ad10849178aa63a00ffc1dee7e05
                                                                                                                              • Instruction Fuzzy Hash: 07D18D71900259EFDF819FA4CE88ADE7B75FB09754F10413AF916A6160DF318AB0DB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8C50E Relevance: 24.4, APIs: 16, Instructions: 391COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LCMapStringW.KERNEL32(00000000,00000100,00A82A18,00000001,00000000,00000000,00A962D0,0000002C,00A8C9FB,00004000,00000000,00004000,?,?,?,?), ref: 00A8C538
                                                                                                                              • GetLastError.KERNEL32(?,00A8AFE2,00A81303,UTF-8,?,00A81304,00000000,C:\Windows\Logs\DirectX.log), ref: 00A8C54A
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00A962D0,0000002C,00A8C9FB,00004000,00000000,00004000,?,?,?,?), ref: 00A8C5D9
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 00A8C68D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastString
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2717499641-0
                                                                                                                              • Opcode ID: 0a55b47400fbbbb88f60e8191d555036f7a9df0456b72abdb64aa27b96103e90
                                                                                                                              • Instruction ID: 8dad2a585a36e395a64edd85b0f6ccf9f02eaa0d439e46c4d3f4cc0d149e971f
                                                                                                                              • Opcode Fuzzy Hash: 0a55b47400fbbbb88f60e8191d555036f7a9df0456b72abdb64aa27b96103e90
                                                                                                                              • Instruction Fuzzy Hash: 4FD18B72900219EFDF11AFA4DD859EE7BB5FF08720F24422AF915A6261D7318D90DFA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974DDBA Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 171fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _strrchr.LIBCMT ref: 6974DE42
                                                                                                                              • _strrchr.LIBCMT ref: 6974DE59
                                                                                                                              • _strrchr.LIBCMT ref: 6974DE9C
                                                                                                                              • DeleteFileA.KERNEL32 ref: 6974DF29
                                                                                                                                • Part of subcall function 69746CEC: FindFirstFileA.KERNELBASE(?,?,?,00000104,?,\ntkrnlpa.exe,00000104), ref: 69746D8F
                                                                                                                                • Part of subcall function 69746CEC: FindClose.KERNELBASE(00000000), ref: 69746D9B
                                                                                                                              • DeleteFileA.KERNEL32(?,?,00000000), ref: 6974DF18
                                                                                                                              Strings
                                                                                                                              • trying to remove the file %s., xrefs: 6974DE8E
                                                                                                                              • Unable to find '\'., xrefs: 6974DF1C
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp, xrefs: 6974DEF0
                                                                                                                              • Unable to create path string, %sdllcache%s, xrefs: 6974DEDD
                                                                                                                              • CabCallback, xrefs: 6974DEE6
                                                                                                                              • RegisteredPackages, xrefs: 6974DF7E
                                                                                                                              • dxxpdbg, xrefs: 6974DE68
                                                                                                                              • dllcache, xrefs: 6974DEB6
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File_strrchr$DeleteFind$CloseFirst
                                                                                                                              • String ID: CabCallback$RegisteredPackages$Unable to create path string, %sdllcache%s$Unable to find '\'.$dllcache$dxxpdbg$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp$trying to remove the file %s.
                                                                                                                              • API String ID: 2252362552-2484097790
                                                                                                                              • Opcode ID: 729ef0dd583d2f2490ad30b9c86810e290c8812fb165dd6a07d1db1414eedf85
                                                                                                                              • Instruction ID: 05002a6b08fe0f1a89289f515a2ce8a7cfc56cb4b793edb8349f08ce95156b1e
                                                                                                                              • Opcode Fuzzy Hash: 729ef0dd583d2f2490ad30b9c86810e290c8812fb165dd6a07d1db1414eedf85
                                                                                                                              • Instruction Fuzzy Hash: 7B515B35644215ABDB11DA248F49FBA33ACEF81F54F015876E950DB183FF70E5008B54
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974B5F6 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 134COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: CSetup::XSetupCallback$CreateDialog()$Not fatal...$SetDlgItemText()$SetFocus()$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 0-3552151630
                                                                                                                              • Opcode ID: c81048801c5968f9c3c966347276481c4552c475e0034846dd67a3503da2468c
                                                                                                                              • Instruction ID: fc13583e47c0200b8a0658b81ce0a6f56169282afef34156a372beedba11d5b3
                                                                                                                              • Opcode Fuzzy Hash: c81048801c5968f9c3c966347276481c4552c475e0034846dd67a3503da2468c
                                                                                                                              • Instruction Fuzzy Hash: E841BE30A00648EBDB11AF75CF45E9E77B8BB15F04F40853AF566E6542EB30EA608F52
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09505A Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 110COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 6C0950AF
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C0950BE
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C096506
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C09650F
                                                                                                                                • Part of subcall function 6C0964D5: _strrchr.LIBCMT ref: 6C096555
                                                                                                                              • DirectXLoadString.DSETUP32(00001391,?,00000104), ref: 6C095136
                                                                                                                              • DirectXSetupCallback.DSETUP32(0000000A,00000010,?,00000000,00000000), ref: 6C095149
                                                                                                                              • DestroyWindow.USER32 ref: 6C095159
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C095164
                                                                                                                                • Part of subcall function 6C094B10: GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 6C094B43
                                                                                                                                • Part of subcall function 6C094B10: GetLastError.KERNEL32(00000000), ref: 6C094B4E
                                                                                                                                • Part of subcall function 6C0964D5: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 6C096665
                                                                                                                                • Part of subcall function 6C0964D5: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,GetRegistryDXVersion), ref: 6C09668A
                                                                                                                              • DirectXSetupA.DSETUP(?,00000000,?), ref: 6C095198
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectErrorLast$Setup__wstrtime$ByteCallbackCharCurrentDestroyDirectoryFormatFreeLoadLocalMessageMultiStringWideWindow_strrchr
                                                                                                                              • String ID: DestroyWindow()$DirectXSetupW$DirectXSetupW()$LoadDSetup32() failed.$WideCharToMultiByte()$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 611871445-3988145944
                                                                                                                              • Opcode ID: d3c7649697b3e10cd9af377aae33b9b919764785fc5c49e60a58a96293a32075
                                                                                                                              • Instruction ID: 6095b3f2af78d338006e0c4e06fcd8bea3c316ad1d4e9b6619c46dc9a4aba8f8
                                                                                                                              • Opcode Fuzzy Hash: d3c7649697b3e10cd9af377aae33b9b919764785fc5c49e60a58a96293a32075
                                                                                                                              • Instruction Fuzzy Hash: 78311079701614BBDB009EA69C88FEF3BFCFB06B64F001601F529D6581DB709940ABA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974625B Relevance: 22.8, APIs: 4, Strings: 9, Instructions: 80COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetWindowsDirectoryA.KERNEL32(?,00000104,69747D8D,00000000), ref: 69746291
                                                                                                                              • OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.,69747D8D,00000000), ref: 697462A0
                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 697462E0
                                                                                                                              • GetLastError.KERNEL32 ref: 697462EA
                                                                                                                              Strings
                                                                                                                              • DXSETUP_DPF(): failed to create log directory., xrefs: 697462F7
                                                                                                                              • \Logs, xrefs: 697462AB
                                                                                                                              • DXSETUP_DPF(): path name too long., xrefs: 697462D0
                                                                                                                              • --------------------, xrefs: 69746340
                                                                                                                              • Logs\DXError.log, xrefs: 697462FE
                                                                                                                              • DXSETUP_DPF(): Unable to open log file., xrefs: 69746335
                                                                                                                              • %s%s, xrefs: 697462B7
                                                                                                                              • %s%s%s, xrefs: 6974630F
                                                                                                                              • DXSETUP_DPF(): GetWindowsDirectory() failed., xrefs: 6974629B
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Directory$CreateDebugErrorLastOutputStringWindows
                                                                                                                              • String ID: %s%s$%s%s%s$--------------------$DXSETUP_DPF(): GetWindowsDirectory() failed.$DXSETUP_DPF(): Unable to open log file.$DXSETUP_DPF(): failed to create log directory.$DXSETUP_DPF(): path name too long.$Logs\DXError.log$\Logs
                                                                                                                              • API String ID: 3967814497-1050326959
                                                                                                                              • Opcode ID: 404083ea26cfbca1e32b329471d10985af7b922839e27d57c6cc0a2b1e25d65d
                                                                                                                              • Instruction ID: f8d4da0c2548979b46a8cd3c2311978bbb44e7474c3769a487fc5ac682dea832
                                                                                                                              • Opcode Fuzzy Hash: 404083ea26cfbca1e32b329471d10985af7b922839e27d57c6cc0a2b1e25d65d
                                                                                                                              • Instruction Fuzzy Hash: 6F21A279A04258BBD750F765CF09FDE376C9B62F64F8040B6F944E2403EB30AB608A65
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A84629 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 127filestringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A8465D
                                                                                                                              • OutputDebugStringA.KERNEL32(DXSetup: GetRequiredDiskSpaceFromLog(): path name too long.), ref: 00A8466C
                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00A846B4
                                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 00A846CD
                                                                                                                              • ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00A846FF
                                                                                                                              • lstrlenA.KERNEL32(needed = ), ref: 00A84734
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00A84770
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CloseCreateDebugDirectoryHandleOutputReadSizeStringWindowslstrlen
                                                                                                                              • String ID: DXSetup: GetRequiredDiskSpaceFromLog(): GetWindowsDirectory() failed.$DXSetup: GetRequiredDiskSpaceFromLog(): path name too long.$Logs\DirectX.log$Not enough disk space$needed =
                                                                                                                              • API String ID: 806678891-479621395
                                                                                                                              • Opcode ID: d725d905b17a52e9cfc679dab09fd6c7e5b1d468e3a179c833786f4d43b81e05
                                                                                                                              • Instruction ID: 6a936a23048ac732255fb38f6b923b1aa2c48f82beb5a00f59f2de52fc56fba0
                                                                                                                              • Opcode Fuzzy Hash: d725d905b17a52e9cfc679dab09fd6c7e5b1d468e3a179c833786f4d43b81e05
                                                                                                                              • Instruction Fuzzy Hash: AF41C7719403196FDB10BB749DC9AEE7BBCEB55750F1005B9F119E6090EB708DC28B50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A83803 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 80COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A83839
                                                                                                                              • OutputDebugStringA.KERNEL32(DXSETUP_DPF(): Unable to open log file.), ref: 00A83848
                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 00A83888
                                                                                                                              • GetLastError.KERNEL32 ref: 00A83892
                                                                                                                              Strings
                                                                                                                              • DXSETUP_DPF(): failed to create log directory., xrefs: 00A8389F
                                                                                                                              • DXSETUP_DPF(): GetWindowsDirectory() failed., xrefs: 00A83843
                                                                                                                              • %s%s, xrefs: 00A8385F
                                                                                                                              • DXSETUP_DPF(): Unable to open log file., xrefs: 00A838DD
                                                                                                                              • %s%s%s, xrefs: 00A838B7
                                                                                                                              • DXSETUP_DPF(): path name too long., xrefs: 00A83878
                                                                                                                              • Logs\DXError.log, xrefs: 00A838A6
                                                                                                                              • \Logs, xrefs: 00A83853
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Directory$CreateDebugErrorLastOutputStringWindows
                                                                                                                              • String ID: %s%s$%s%s%s$DXSETUP_DPF(): GetWindowsDirectory() failed.$DXSETUP_DPF(): Unable to open log file.$DXSETUP_DPF(): failed to create log directory.$DXSETUP_DPF(): path name too long.$Logs\DXError.log$\Logs
                                                                                                                              • API String ID: 3967814497-3230818052
                                                                                                                              • Opcode ID: 2ea545b530d64a23769e319a2f71ee8a4fa8b7c2f1bd896a5a61e9023d714405
                                                                                                                              • Instruction ID: cf9a76edc2d70c724b61a12978ff708c9426504faf89ede3fceb6700a352ba5d
                                                                                                                              • Opcode Fuzzy Hash: 2ea545b530d64a23769e319a2f71ee8a4fa8b7c2f1bd896a5a61e9023d714405
                                                                                                                              • Instruction Fuzzy Hash: 2421DEB2E443147ADB20F7A5DC0AFEA37ACEB50F10F2009B9F545E6581FA64CB468761
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09E8F3 Relevance: 19.7, APIs: 13, Instructions: 189COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fileno$__cftof
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1302671315-0
                                                                                                                              • Opcode ID: 3ca35ec5403420d2537f382e58148615cbb884373e4e98fbf6108529085227bc
                                                                                                                              • Instruction ID: eb8b294d7ea800bcafbbece9a1699923cf19621085b19399b3a419012fcf935a
                                                                                                                              • Opcode Fuzzy Hash: 3ca35ec5403420d2537f382e58148615cbb884373e4e98fbf6108529085227bc
                                                                                                                              • Instruction Fuzzy Hash: 8D51F7311059169EC7258B28D881BAEB7E4FF03338734264AF0B5C7AE1DB31E945E695
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0938AC Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 91registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegOpenKeyExA.ADVAPI32(80000002,software\microsoft\directx,00000000,00000001,?), ref: 6C0938ED
                                                                                                                              • RegQueryValueExA.ADVAPI32 ref: 6C093943
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6C0939A4
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C096506
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C09650F
                                                                                                                                • Part of subcall function 6C0964D5: _strrchr.LIBCMT ref: 6C096555
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$CloseOpenQueryValue_strrchr
                                                                                                                              • String ID: GetRegistryDXVersion$RegCloseKey()$RegOpenKeyEx()$RegQueryValueEx()$StringToVersionInfo() failed.$Version$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c$software\microsoft\directx
                                                                                                                              • API String ID: 4010714187-3998709912
                                                                                                                              • Opcode ID: 9ffb85800fe6768050b2e58ecd5e1c8b461b1325e1e76f6d132876386e49ff2f
                                                                                                                              • Instruction ID: d1e6764e093a153fbfd524c4fe9b5495e745bf34b2feea223d409fa25a1bf1a4
                                                                                                                              • Opcode Fuzzy Hash: 9ffb85800fe6768050b2e58ecd5e1c8b461b1325e1e76f6d132876386e49ff2f
                                                                                                                              • Instruction Fuzzy Hash: C12185B1A0411C7AEB109B948C85FEB76FCEB59348F406595B60DE3941DAB09E84AEA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A86BDC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 89windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadStringW.USER32(00000000,0000006F,?,00000200), ref: 00A86C22
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 00A86C2D
                                                                                                                                • Part of subcall function 00A84629: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A8465D
                                                                                                                                • Part of subcall function 00A84629: OutputDebugStringA.KERNEL32(DXSetup: GetRequiredDiskSpaceFromLog(): path name too long.), ref: 00A8466C
                                                                                                                              • ___swprintf_l.LIBCMT ref: 00A86C69
                                                                                                                              • LoadStringW.USER32(00000000,00001F40,?,00000200), ref: 00A86C80
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 00A86C8B
                                                                                                                              • LoadStringW.USER32(00000000,00000030,?,00000200), ref: 00A86CAA
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 00A86CB5
                                                                                                                              • MessageBoxW.USER32 ref: 00A86CDF
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: String$ErrorLastLoad$DebugDirectoryMessageOutputWindows___swprintf_l
                                                                                                                              • String ID: LoadString()$ShowMessage$e:\bt\382730\setup\deliverables\dxsetup\utils.cpp
                                                                                                                              • API String ID: 1139171496-2358067398
                                                                                                                              • Opcode ID: 93a414a6c78a384b94a647c24ecaeb56fd57f5d5b512a0f7c782461178569e0b
                                                                                                                              • Instruction ID: c03984c895546a68f5b3dbcd839e1990bad3c3ef2fe1e4b12a8e2cf4b66556f2
                                                                                                                              • Opcode Fuzzy Hash: 93a414a6c78a384b94a647c24ecaeb56fd57f5d5b512a0f7c782461178569e0b
                                                                                                                              • Instruction Fuzzy Hash: 452144F5640218BAEB10FBA4DD89FEB77ACFB04701F400565F745E6081EA74EA068B64
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A83DF6 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 79COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetFileVersionInfoSizeA.VERSION(?,?), ref: 00A83E07
                                                                                                                                • Part of subcall function 00A83D50: _strrchr.LIBCMT ref: 00A83D5B
                                                                                                                              • GetLastError.KERNEL32(?,?), ref: 00A83E1E
                                                                                                                              • _memset.LIBCMT ref: 00A83E76
                                                                                                                              • GetFileVersionInfoA.VERSION(?,00000000,00000000,00000000), ref: 00A83E84
                                                                                                                              • GetLastError.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00A83E8E
                                                                                                                              Strings
                                                                                                                              • Unable to allocate memory., xrefs: 00A83E53
                                                                                                                              • GetFileVersionInfoBlock, xrefs: 00A83E5A, 00A83E9A
                                                                                                                              • GetFileVersionInfoBlock(): %s does not have version information., xrefs: 00A83E36
                                                                                                                              • GetFileVersionInfo(), xrefs: 00A83E95
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 00A83E64, 00A83EA4
                                                                                                                              • GetFileVersionInfoBlock(): Unable to get FileVersionInfoSize, file: %s, reason: %d., xrefs: 00A83E26
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileInfoLastVersion$Size_memset_strrchr
                                                                                                                              • String ID: GetFileVersionInfo()$GetFileVersionInfoBlock$GetFileVersionInfoBlock(): %s does not have version information.$GetFileVersionInfoBlock(): Unable to get FileVersionInfoSize, file: %s, reason: %d.$Unable to allocate memory.$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 388213077-1642510695
                                                                                                                              • Opcode ID: 2f9a1d31bf0d04b2ccb9d498efeeea5da1b749ba5047ee888f481ce0549feefc
                                                                                                                              • Instruction ID: 14cb5bd06d482939cf57c3c90098f2a4ebec36ec4d03a7ba300f281ee9eaa412
                                                                                                                              • Opcode Fuzzy Hash: 2f9a1d31bf0d04b2ccb9d498efeeea5da1b749ba5047ee888f481ce0549feefc
                                                                                                                              • Instruction Fuzzy Hash: EE1108F3A046147EAF207BA45D8BCBF29DCED56F947144525FA02B1142FA918F0243F5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A84288 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 76windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetWindowTextA.USER32(?,?,00000208), ref: 00A842B0
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 00A842BB
                                                                                                                              • GetClassNameA.USER32(?,?,00000208), ref: 00A842EB
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 00A842F6
                                                                                                                              • SetForegroundWindow.USER32(?), ref: 00A84347
                                                                                                                              • SetFocus.USER32 ref: 00A8434E
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastWindow$ClassFocusForegroundNameText
                                                                                                                              • String ID: 32770$FindDXSetupWindow$GetClassName()$GetWindowText()$e:\bt\382730\setup\deliverables\dxsetup\dxsetup.cpp
                                                                                                                              • API String ID: 4084711242-343571156
                                                                                                                              • Opcode ID: 7ca18e5af202e2cc467b547118bba6d3f2e9df2511e62e7d594122b5cc1f3cf7
                                                                                                                              • Instruction ID: a27ef9ed279010bdf0aea414d9e721564ac46b85a9c1eff02deb74131bb898f6
                                                                                                                              • Opcode Fuzzy Hash: 7ca18e5af202e2cc467b547118bba6d3f2e9df2511e62e7d594122b5cc1f3cf7
                                                                                                                              • Instruction Fuzzy Hash: 3F21A2B6A04209BAD700FBB09D49EFE77BCEB49710F200569F941E2041EB38DA428B75
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974E101 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 144fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 6974BA00: CharLowerA.USER32 ref: 6974BA17
                                                                                                                                • Part of subcall function 6974BA00: _strrchr.LIBCMT ref: 6974BA31
                                                                                                                              • DeleteFileA.KERNEL32(?,?,00000000,?,00000104), ref: 6974E157
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6974E162
                                                                                                                              • _strrchr.LIBCMT ref: 6974E1BB
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _strrchr$CharDeleteErrorFileLastLower
                                                                                                                              • String ID: CabCallback$DeleteFile()$Deleted file %s with DELAY_UNTIL_REBOOT.$MoveFileEx()$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 1206630738-28221962
                                                                                                                              • Opcode ID: 3d56f7ffb30b0146baefa612c4e58f7584b85ce7e4983bba9ba8f886047212e2
                                                                                                                              • Instruction ID: 7c540d11ae7fc1f3d93ee2656729e2f5f848bbd61a8cf171b6c191c4c70a02d1
                                                                                                                              • Opcode Fuzzy Hash: 3d56f7ffb30b0146baefa612c4e58f7584b85ce7e4983bba9ba8f886047212e2
                                                                                                                              • Instruction Fuzzy Hash: 3641F075644618ABEB41DB748F49BBA37A8FF42F64F004472E811D6083EF70EA408E91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A853CE Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(00000000,00001F49,?,00000258), ref: 00A8544E
                                                                                                                              • LoadStringA.USER32 ref: 00A85457
                                                                                                                              • GetModuleHandleA.KERNEL32(00000000,?,?,00000258), ref: 00A85473
                                                                                                                              • LoadStringA.USER32 ref: 00A85476
                                                                                                                                • Part of subcall function 00A852DE: GetDlgItem.USER32(?,00000BB9), ref: 00A852EC
                                                                                                                                • Part of subcall function 00A852DE: SendMessageA.USER32 ref: 00A8530A
                                                                                                                                • Part of subcall function 00A852DE: SendMessageA.USER32 ref: 00A85316
                                                                                                                                • Part of subcall function 00A852DE: SendMessageA.USER32 ref: 00A85322
                                                                                                                                • Part of subcall function 00A852DE: ShowWindow.USER32(00000000,00000001), ref: 00A85327
                                                                                                                              • SetDlgItemTextA.USER32(00000000,00000BBC,00A81ED4), ref: 00A854D3
                                                                                                                              • GetModuleHandleA.KERNEL32(00000000,00001F40,?,00000080), ref: 00A854FD
                                                                                                                              • LoadStringA.USER32 ref: 00A85504
                                                                                                                              • GetParent.USER32(00000000), ref: 00A8551C
                                                                                                                              • MessageBoxA.USER32 ref: 00A85523
                                                                                                                              Strings
                                                                                                                              • DSetupCallback(): Phase = %d, Steps = %d, xrefs: 00A85414
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$HandleLoadModuleSendString$Item$ParentShowTextWindow
                                                                                                                              • String ID: DSetupCallback(): Phase = %d, Steps = %d
                                                                                                                              • API String ID: 3174243963-1040383907
                                                                                                                              • Opcode ID: 2e6d0bde94c422d2b6011343b3bb40510fa1c57673e778c2be1434bde30d45e5
                                                                                                                              • Instruction ID: dfea4556ae274ad1b388e85803cfb8d761ab0c81c4207430cb953e013adb9731
                                                                                                                              • Opcode Fuzzy Hash: 2e6d0bde94c422d2b6011343b3bb40510fa1c57673e778c2be1434bde30d45e5
                                                                                                                              • Instruction Fuzzy Hash: 62315072A00619AFCF10EFA4DC89EAA77B9FB48345F104459FA05A7150DB709E82CF50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0956D4 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 88COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DirectXLoadString.DSETUP32(?,?,00000104,00000104,00000000), ref: 6C095735
                                                                                                                                • Part of subcall function 6C094B10: GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 6C094B43
                                                                                                                                • Part of subcall function 6C094B10: GetLastError.KERNEL32(00000000), ref: 6C094B4E
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000,?), ref: 6C095766
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 6C09578F
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C095796
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharErrorLastMultiWide$CurrentDirectDirectoryLoadString
                                                                                                                              • String ID: Insufficient buffer.$LoadDSetup32() failed.$MultiByteToWideChar()$MyLoadStringW$XDirectXLoadString() failed.$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 2176918339-3711276564
                                                                                                                              • Opcode ID: 77df42d0fa269dd79d9fa817b5061f061d0c81c8dbbefbb5cb8c94821608b0c8
                                                                                                                              • Instruction ID: 0d5c9637095c74fe045043b1e9806736449f89ccd1392614539d4a98e1ce2ae7
                                                                                                                              • Opcode Fuzzy Hash: 77df42d0fa269dd79d9fa817b5061f061d0c81c8dbbefbb5cb8c94821608b0c8
                                                                                                                              • Instruction Fuzzy Hash: 9921373470811CBADB10EA679C80FAF76FCE786755F402615F559E18C0EB20DB01BA70
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69748635 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 64libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetProcAddress.KERNEL32(?,?), ref: 6974864E
                                                                                                                              • FreeLibrary.KERNEL32 ref: 69748693
                                                                                                                              • GetLastError.KERNEL32 ref: 6974869D
                                                                                                                                • Part of subcall function 69746391: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 69746521
                                                                                                                                • Part of subcall function 69746391: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00066BDB), ref: 69746546
                                                                                                                              • GetLastError.KERNEL32(Module: %s, Function: %s,?,?,?,?,?), ref: 6974866C
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFreeLast__wstrtime$AddressFormatLibraryLocalMessageProc_strrchr
                                                                                                                              • String ID: CDllLoader::GetProcAddress$FreeLibrary()$GetProcAddress()$Invalid member - m_hModule is NULL.$Module: %s, Function: %s$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 2317682547-2938890287
                                                                                                                              • Opcode ID: f4473fedf4801b6a321c426cb690579e3320977e0c87f19568b0a1e9da5ce554
                                                                                                                              • Instruction ID: f586ea630b6278d99dd88af2c720ebc7413240aff2f658445e3a87eb257f7f78
                                                                                                                              • Opcode Fuzzy Hash: f4473fedf4801b6a321c426cb690579e3320977e0c87f19568b0a1e9da5ce554
                                                                                                                              • Instruction Fuzzy Hash: A211E971900148FBDB51AB55CE44EBF36ADEBA6F44F604025F944EA143F6319F208AA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A851F7 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 64libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetProcAddress.KERNEL32(?,?), ref: 00A85210
                                                                                                                              • FreeLibrary.KERNEL32 ref: 00A85255
                                                                                                                              • GetLastError.KERNEL32 ref: 00A8525F
                                                                                                                                • Part of subcall function 00A8390A: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00A83A9A
                                                                                                                                • Part of subcall function 00A8390A: LocalFree.KERNEL32(?), ref: 00A83ABF
                                                                                                                              • GetLastError.KERNEL32(Module: %s, Function: %s,?,?,?,?,?), ref: 00A8522E
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFreeLast__wstrtime$AddressFormatLibraryLocalMessageProc_strrchr
                                                                                                                              • String ID: CDllLoader::GetProcAddress$FreeLibrary()$GetProcAddress()$Invalid member - m_hModule is NULL.$Module: %s, Function: %s$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 2317682547-2938890287
                                                                                                                              • Opcode ID: 23e10fa66b6502c5f86351b81ae60a39b39e8eb89b68735cd4beb9afadcb4e2e
                                                                                                                              • Instruction ID: 2a2c9ff19b9a5cad7346703bb5f962bdba1ab4ebbbe40c6dcb30cc547079e0a8
                                                                                                                              • Opcode Fuzzy Hash: 23e10fa66b6502c5f86351b81ae60a39b39e8eb89b68735cd4beb9afadcb4e2e
                                                                                                                              • Instruction Fuzzy Hash: C711C4B6E40208BFD711BFA1CC46E7B7AADEB94B54F140519FD44E6181F6B08E038BA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69757AF6 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 150fileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __set_error_mode.LIBCMT ref: 69757B27
                                                                                                                              • __set_error_mode.LIBCMT ref: 69757B38
                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,6975EE81,00000104,00066BDB,69747D8D), ref: 69757B98
                                                                                                                              • GetStdHandle.KERNEL32(000000F4,00000001,00066BCC,00000000,00000003,00000003,?,69757CAC,000000FC,6975497D,6975B5E8,0000000C,69754A3F,69747D8D,00066BCC), ref: 69757C42
                                                                                                                              • WriteFile.KERNEL32(00000000,?,?,69747D8D,00000000), ref: 69757C70
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File__set_error_mode$HandleModuleNameWrite
                                                                                                                              • String ID: <program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $hui
                                                                                                                              • API String ID: 3248813247-1797925410
                                                                                                                              • Opcode ID: 8b76ec34294bb94865fd137488edf25f67ae094fc4a3b938fbcc745ec4e7ccfe
                                                                                                                              • Instruction ID: 8a97fff7e9ff1cfad3648fbc471b787b7153933268808baf22547acb0d4eb431
                                                                                                                              • Opcode Fuzzy Hash: 8b76ec34294bb94865fd137488edf25f67ae094fc4a3b938fbcc745ec4e7ccfe
                                                                                                                              • Instruction Fuzzy Hash: 62312AB2E00240B7FAC16E385F49E6F365DAF52658F04D038E907A6182FE22863181F1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974C02F Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 142COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CompareString
                                                                                                                              • String ID: CSetup::CheckForceCopy$CheckForceCopy(): Unablt to get target file name from %s, skip it.$CheckForceCopy(): no file list in section, skip checking force copy.$DX_FORCECOPY_FILE$LoadListFromInfSection() failed.$MakeForceCopyList() failed.$Unable to create path string, %s%s.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 1825529933-3866404779
                                                                                                                              • Opcode ID: a5beeadc53d7eb653e4f87cefd0468ee8ce96f682f1d908391fc35b3cde80b29
                                                                                                                              • Instruction ID: 2b2d61a8369a88fd80296300896b2b1519ac4b04123af35f233aa2962a4c76c3
                                                                                                                              • Opcode Fuzzy Hash: a5beeadc53d7eb653e4f87cefd0468ee8ce96f682f1d908391fc35b3cde80b29
                                                                                                                              • Instruction Fuzzy Hash: 504119B1A44209FEEF11CB24CF45FEA77A8AF06F55F044465E958E6093EB70AA84CF50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974C1ED Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 138COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp, xrefs: 6974C275, 6974C2FB
                                                                                                                              • LoadListFromInfSection() failed., xrefs: 6974C2BF
                                                                                                                              • CheckForceCopy(): Unablt to get target file name from %s, skip it., xrefs: 6974C353
                                                                                                                              • DX_FORCECOPY_FILE_TIMESTAMP, xrefs: 6974C287, 6974C28C, 6974C2B4
                                                                                                                              • Unable to create path string, %s%s., xrefs: 6974C264
                                                                                                                              • MakeForceCopyList() failed., xrefs: 6974C2EA
                                                                                                                              • CheckForceCopy(): no file list in section, skip checking force copy., xrefs: 6974C30C
                                                                                                                              • CSetup::CheckForceCopy, xrefs: 6974C26B, 6974C2C8, 6974C2F1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CompareString
                                                                                                                              • String ID: CSetup::CheckForceCopy$CheckForceCopy(): Unablt to get target file name from %s, skip it.$CheckForceCopy(): no file list in section, skip checking force copy.$DX_FORCECOPY_FILE_TIMESTAMP$LoadListFromInfSection() failed.$MakeForceCopyList() failed.$Unable to create path string, %s%s.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 1825529933-3124809831
                                                                                                                              • Opcode ID: 592256fffc45b87d4e4c185119b4f311990336fd1317a0d0530d5ca6383387de
                                                                                                                              • Instruction ID: f1202e05639ac40182ef0aee287db5d2272370abd39c9e19a000fb3e2b308d81
                                                                                                                              • Opcode Fuzzy Hash: 592256fffc45b87d4e4c185119b4f311990336fd1317a0d0530d5ca6383387de
                                                                                                                              • Instruction Fuzzy Hash: 3D411971A44208BEEF10CB64CF06FEA77ACAF06F55F044465E558E6083DB70AA848F91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6975A1BE Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 135memorylibraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __get_wpgmptr.LIBCMT ref: 6975A1DC
                                                                                                                              • VirtualQuery.KERNEL32(?,?,0000001C), ref: 6975A207
                                                                                                                              • GetSystemInfo.KERNEL32(?), ref: 6975A21F
                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6975A248
                                                                                                                              • GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 6975A258
                                                                                                                              • VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6975A2DF
                                                                                                                              • VirtualProtect.KERNEL32(?,?,?,?), ref: 6975A2F2
                                                                                                                                • Part of subcall function 697532D7: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 6975336B
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Virtual$AddressAllocDebugHandleInfoModuleOutputProcProtectQueryStringSystem__get_wpgmptr
                                                                                                                              • String ID: SetThreadStackGuarantee$kernel32.dll
                                                                                                                              • API String ID: 2401657611-423161677
                                                                                                                              • Opcode ID: 077955cf6df6d774e9b7436f73433b8f2c35b4ae38d337eec0bd65291568333e
                                                                                                                              • Instruction ID: bb4d8dd695df7903a10df04a049f679a3f55f18428d1c4f9e68ed370b060e7c0
                                                                                                                              • Opcode Fuzzy Hash: 077955cf6df6d774e9b7436f73433b8f2c35b4ae38d337eec0bd65291568333e
                                                                                                                              • Instruction Fuzzy Hash: 1141A176E00108AFDF44DFA5CE85AEEBBB9FF88764F104475E512E6100EB319651CBA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0A215A Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 135memorylibraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __get_wpgmptr.LIBCMT ref: 6C0A2178
                                                                                                                              • VirtualQuery.KERNEL32(?,?,0000001C), ref: 6C0A21A3
                                                                                                                              • GetSystemInfo.KERNEL32(?), ref: 6C0A21BB
                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6C0A21E4
                                                                                                                              • GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 6C0A21F4
                                                                                                                              • VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C0A227B
                                                                                                                              • VirtualProtect.KERNEL32(?,?,?,?), ref: 6C0A228E
                                                                                                                                • Part of subcall function 6C099B83: OutputDebugStringA.KERNEL32(Invalid parameter passed to C runtime function.), ref: 6C099C17
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Virtual$AddressAllocDebugHandleInfoModuleOutputProcProtectQueryStringSystem__get_wpgmptr
                                                                                                                              • String ID: SetThreadStackGuarantee$kernel32.dll
                                                                                                                              • API String ID: 2401657611-423161677
                                                                                                                              • Opcode ID: 93cf91492ec70cde431aaee9a7228139eb3f759c66d89245c3105139763389c9
                                                                                                                              • Instruction ID: cd750e7aad1fd11b9ec23a3410246d9b81b8bf3c60a3cb77299953ff30f50545
                                                                                                                              • Opcode Fuzzy Hash: 93cf91492ec70cde431aaee9a7228139eb3f759c66d89245c3105139763389c9
                                                                                                                              • Instruction Fuzzy Hash: 8C416F72E00108BBDB01DFE6CC88BEEBBF9FB48704F100565E619E7541DB30A6869B50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974B8F8 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 96windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _strrchr.LIBCMT ref: 6974B90E
                                                                                                                              • GetDlgItem.USER32(?,00001770), ref: 6974B936
                                                                                                                              • SendMessageA.USER32 ref: 6974B93D
                                                                                                                              • SetDlgItemTextA.USER32(?,00000FA3,69742B57), ref: 6974B975
                                                                                                                              • GetLastError.KERNEL32(Not fatal...,?,6974B648,?), ref: 6974B984
                                                                                                                              Strings
                                                                                                                              • Not fatal..., xrefs: 6974B97F
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp, xrefs: 6974B99A
                                                                                                                              • SetDlgItemText(), xrefs: 6974B98B
                                                                                                                              • CSetup::UpdateProgress, xrefs: 6974B990
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Item$ErrorLastMessageSendText_strrchr
                                                                                                                              • String ID: CSetup::UpdateProgress$Not fatal...$SetDlgItemText()$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 2316621201-1266400068
                                                                                                                              • Opcode ID: 9a870f4fc6fa8b4ed594c154f00dde061fa9de41bb70fca00d749ab7e09062e5
                                                                                                                              • Instruction ID: df320bb718a6993286a006f065e8bb87cd413ad76289845237d2c4911f8390fe
                                                                                                                              • Opcode Fuzzy Hash: 9a870f4fc6fa8b4ed594c154f00dde061fa9de41bb70fca00d749ab7e09062e5
                                                                                                                              • Instruction Fuzzy Hash: 50219131344B44AFDF219A55CE89D7F77A9EB8AF00B50442AF946D6542E721FD40C624
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974CB95 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 63registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 697495AC: CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000003,00000080,00000000), ref: 697495C6
                                                                                                                                • Part of subcall function 697495AC: GetLastError.KERNEL32 ref: 697495D1
                                                                                                                              • RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000000,00000002,?), ref: 6974CBDD
                                                                                                                              • RegSetValueExA.ADVAPI32(?,AllowProtectedRenames,00000000,00000004,00000001,00000004), ref: 6974CBF9
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 6974CC13
                                                                                                                              Strings
                                                                                                                              • CheckInUse(): RegSetValueEx() failed, error = %d., xrefs: 6974CC04
                                                                                                                              • CheckInUse(): RegOpenKeyEx() failed, error = %d., xrefs: 6974CC26
                                                                                                                              • CheckInUse(): RegCloseKey() failed, error = %d., xrefs: 6974CC1E
                                                                                                                              • SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 6974CBD3
                                                                                                                              • In use: %s., xrefs: 6974CBBF
                                                                                                                              • AllowProtectedRenames, xrefs: 6974CBF1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseCreateErrorFileLastOpenValue
                                                                                                                              • String ID: AllowProtectedRenames$CheckInUse(): RegCloseKey() failed, error = %d.$CheckInUse(): RegOpenKeyEx() failed, error = %d.$CheckInUse(): RegSetValueEx() failed, error = %d.$In use: %s.$SYSTEM\CurrentControlSet\Control\Session Manager
                                                                                                                              • API String ID: 1189079733-2090263386
                                                                                                                              • Opcode ID: 03911b6b01d93ed60ab8827937ce32e2ed263fceda0e2cbcff3b69f11ba5d72e
                                                                                                                              • Instruction ID: fd62c3d9c0dbe4eb231c96ae731b14955fd5dfc8096b773dda917c87b49f0333
                                                                                                                              • Opcode Fuzzy Hash: 03911b6b01d93ed60ab8827937ce32e2ed263fceda0e2cbcff3b69f11ba5d72e
                                                                                                                              • Instruction Fuzzy Hash: 1111A975688104BEFF00EF60DF06FAD7BA8DB14F19F50442AB500E6093DF319A548618
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A83EC7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 62COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _memset.LIBCMT ref: 00A83ED7
                                                                                                                                • Part of subcall function 00A83DF6: GetFileVersionInfoSizeA.VERSION(?,?), ref: 00A83E07
                                                                                                                                • Part of subcall function 00A83DF6: GetLastError.KERNEL32(?,?), ref: 00A83E1E
                                                                                                                              • VerQueryValueW.VERSION(00000000,00A81794,?,?), ref: 00A83EFF
                                                                                                                              • GetLastError.KERNEL32(00000000,00000000,00A81794,?,?), ref: 00A83F09
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast$FileInfoQuerySizeValueVersion_memset
                                                                                                                              • String ID: 4$DXGetFileVersion$Data size mismatch.$VerQueryValue()$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 2833552196-926253235
                                                                                                                              • Opcode ID: e19afaf45ed7a6df5e3b194c8aab9626cfb8e336d98d971cb274569cd88709d3
                                                                                                                              • Instruction ID: b4827a1a817e19a184ed6eadcd432a9d4e2d9d5dc86be1ccfbedd4f1af611146
                                                                                                                              • Opcode Fuzzy Hash: e19afaf45ed7a6df5e3b194c8aab9626cfb8e336d98d971cb274569cd88709d3
                                                                                                                              • Instruction Fuzzy Hash: 6001DB72744308BAEF0176548D87F6E366CEB41F94F204828F705A9081E6B19F469751
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697466FB Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _strrchr.LIBCMT ref: 69746706
                                                                                                                                • Part of subcall function 697466CC: CompareStringA.KERNEL32(00000409,00000001,69746892,000000FF,?,000000FF,?,69746723,00000001,inf,69746892,?,697467C5,69746892,69746892,?), ref: 697466E2
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CompareString_strrchr
                                                                                                                              • String ID: chm$dls$fon$hlp$inf$ini$png$txt
                                                                                                                              • API String ID: 987711976-1006119773
                                                                                                                              • Opcode ID: 17913a14fcb1228801fc2ce953dc6d4d33659f9a97c22ec72bb3fdcc6c35896d
                                                                                                                              • Instruction ID: 9453ad965d96ec58d86448ad78890d11ad87a284d94758842ec65b989b0b1018
                                                                                                                              • Opcode Fuzzy Hash: 17913a14fcb1228801fc2ce953dc6d4d33659f9a97c22ec72bb3fdcc6c35896d
                                                                                                                              • Instruction Fuzzy Hash: 1701FBA9A55B23713643A2724F08FDFB5CC5D93F94B409034A825EA057FF05F32980AA
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A83D50 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _strrchr.LIBCMT ref: 00A83D5B
                                                                                                                                • Part of subcall function 00A83C10: CompareStringA.KERNEL32(00000409,00000001,?,000000FF,?,000000FF), ref: 00A83C26
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CompareString_strrchr
                                                                                                                              • String ID: chm$dls$fon$hlp$inf$ini$png$txt
                                                                                                                              • API String ID: 987711976-1006119773
                                                                                                                              • Opcode ID: f2127f08ea3442707dff0892e2a291a1793aaf1b9db2a9be1eafdaf571e05703
                                                                                                                              • Instruction ID: 3be241e3eaa07e152e6d2f3f27a52ae8e1ac462726c2a4f664af2013cbb66ceb
                                                                                                                              • Opcode Fuzzy Hash: f2127f08ea3442707dff0892e2a291a1793aaf1b9db2a9be1eafdaf571e05703
                                                                                                                              • Instruction Fuzzy Hash: 5301A8B3285762315E2536324E06D9F298D6D12F95B080C31FB80F1085FA66DB4693A9
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69748783 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 56registryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00000000,00000001,?), ref: 6974879F
                                                                                                                              • RegQueryValueExA.ADVAPI32 ref: 697487C2
                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 697487FB
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseOpenQueryValue
                                                                                                                              • String ID: CSDVersion$GetCSDVersion$RegOpenKeyEx()$RegQueryValueEx()$System\CurrentControlSet\Control\Windows$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h
                                                                                                                              • API String ID: 3677997916-1259003528
                                                                                                                              • Opcode ID: 9741d73ef9748e39931b18f6aea7003010cf334747851d6b764f9125f14d1fcc
                                                                                                                              • Instruction ID: 4adc3e245afba024a062fc61ee263c26b89452ba1241332cf07b37a7fd99fddd
                                                                                                                              • Opcode Fuzzy Hash: 9741d73ef9748e39931b18f6aea7003010cf334747851d6b764f9125f14d1fcc
                                                                                                                              • Instruction Fuzzy Hash: 5D01A975945118FBDB20AA958E09DCF7F7CEB62FA0FA00250F520F1092E7305B21CAE6
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C097B77 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 46libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,6C0A2740,0000000C,6C097C90,00000000,00000000), ref: 6C097B88
                                                                                                                              • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6C097BB1
                                                                                                                              • GetProcAddress.KERNEL32(?,DecodePointer), ref: 6C097BC1
                                                                                                                              • InterlockedIncrement.KERNEL32(6C0A47D8), ref: 6C097BE3
                                                                                                                              • ___addlocaleref.LIBCMT ref: 6C097C0A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref
                                                                                                                              • String ID: @l$DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                              • API String ID: 1389861978-2382086319
                                                                                                                              • Opcode ID: 461db167a2ae624bdb82e94f7f237e588119f243056fbb977aeef7155ac974b0
                                                                                                                              • Instruction ID: 39debe962b58983e748734009b8e4023f1c92c2474969e0ba9b578cff501f2cd
                                                                                                                              • Opcode Fuzzy Hash: 461db167a2ae624bdb82e94f7f237e588119f243056fbb977aeef7155ac974b0
                                                                                                                              • Instruction Fuzzy Hash: A51170B5900701AFEB109FB9D804B9ABBF4AF45304F10691ED4A997B90CB74E500EF50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6975B053 Relevance: 15.2, APIs: 10, Instructions: 198COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetStringTypeW.KERNEL32(00000001,69744E80,00000001,?,?,?,00000000), ref: 6975B094
                                                                                                                              • GetStringTypeW.KERNEL32(?,?,000000FF,?,?,?,00000000), ref: 6975B0CC
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: StringType
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4177115715-0
                                                                                                                              • Opcode ID: b1e1469b83ead00a57759c4bb4c942fee129c320cdcfb70286f8095187d6d467
                                                                                                                              • Instruction ID: 4413cf43e72301e3bc7e173ca672cac6e62a74dde45c8037d8210a7ecac2ecc9
                                                                                                                              • Opcode Fuzzy Hash: b1e1469b83ead00a57759c4bb4c942fee129c320cdcfb70286f8095187d6d467
                                                                                                                              • Instruction Fuzzy Hash: E361D071A00249EFDF91DF95CE849AF7BB5FF8A354B104529E926D7260DB30E860CB60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0A1F6F Relevance: 15.2, APIs: 10, Instructions: 178COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,6C0A0C6A,00000001,?,00000000,?,?,?), ref: 6C0A1FBA
                                                                                                                              • GetCPInfo.KERNEL32(?,00000001,?,6C0A0C6A,00000001,?), ref: 6C0A1FD3
                                                                                                                              • __alloca_probe_16.LIBCMT ref: 6C0A2017
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,6C0A0C6A,00000000,00000000,?,6C0A0C6A,00000001,?,00000000,?,?,?,?,00000000), ref: 6C0A2037
                                                                                                                              • _memset.LIBCMT ref: 6C0A206F
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,6C0A0C6A,?,00000000,?,?,?,?,?,?,?,6C0A0C6A,00000001,?), ref: 6C0A2086
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,6C0A0C6A), ref: 6C0A20A1
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,6C0A0C6A), ref: 6C0A20C7
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,6C0A0C6A), ref: 6C0A20EC
                                                                                                                              • __freea.LIBCMT ref: 6C0A210E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$Info$__alloca_probe_16__freea_memset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 509433266-0
                                                                                                                              • Opcode ID: 15f78c5ae1d249aa38f483911a858f5f40f269ba51bce5722de846ce2871610b
                                                                                                                              • Instruction ID: 431e8df9d064234dfb422d2f42665e8280fd9eb5019ead6489e13647c8fb67c4
                                                                                                                              • Opcode Fuzzy Hash: 15f78c5ae1d249aa38f483911a858f5f40f269ba51bce5722de846ce2871610b
                                                                                                                              • Instruction Fuzzy Hash: 07517B71905119EFDF009FD6CC88EEEBBFAEB09358F108125E628A7652D7319D42DB60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0A0A7B Relevance: 15.2, APIs: 10, Instructions: 166COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetStringTypeW.KERNEL32(00000001,6C09363C,00000001,?,?,?,00000000,?,?,?,6C0A0C6A,00000001,?,00000000,?,?), ref: 6C0A0AAA
                                                                                                                              • GetLastError.KERNEL32(?,6C0A0C6A,00000001,?,00000000,?,?,?,?,00000000,?,00000001,00000000,00000000,00000008,?), ref: 6C0A0ABC
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,00000000,?,?,?,6C0A0C6A,00000001,?,00000000), ref: 6C0A0B21
                                                                                                                              • __alloca_probe_16.LIBCMT ref: 6C0A0B42
                                                                                                                              • _memset.LIBCMT ref: 6C0A0B76
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,00000000,?,00000001,00000000,00000000,00000008,?,00000000), ref: 6C0A0B8B
                                                                                                                              • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6C0A0B99
                                                                                                                              • __freea.LIBCMT ref: 6C0A0BA3
                                                                                                                              • ___ansicp.LIBCMT ref: 6C0A0BCD
                                                                                                                              • GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C0A0C6A,00000001,?,00000000,?), ref: 6C0A0C0E
                                                                                                                                • Part of subcall function 6C0A1F6F: GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,6C0A0C6A,00000001,?,00000000,?,?,?), ref: 6C0A1FBA
                                                                                                                                • Part of subcall function 6C0A1F6F: GetCPInfo.KERNEL32(?,00000001,?,6C0A0C6A,00000001,?), ref: 6C0A1FD3
                                                                                                                                • Part of subcall function 6C0A1F6F: __alloca_probe_16.LIBCMT ref: 6C0A2017
                                                                                                                                • Part of subcall function 6C0A1F6F: _memset.LIBCMT ref: 6C0A206F
                                                                                                                                • Part of subcall function 6C0A1F6F: MultiByteToWideChar.KERNEL32(?,00000001,?,6C0A0C6A,?,00000000,?,?,?,?,?,?,?,6C0A0C6A,00000001,?), ref: 6C0A2086
                                                                                                                                • Part of subcall function 6C0A1F6F: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,6C0A0C6A), ref: 6C0A20A1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$StringType$Info__alloca_probe_16_memset$ErrorLast___ansicp__freea
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2540555508-0
                                                                                                                              • Opcode ID: 4a977f273f807b1b63949b441d225898823e1f16fc5fb94c372838013a7a428b
                                                                                                                              • Instruction ID: 31cb991039797f287b0527d34131e4ec9f940e405bfa350bca963a88f64e9b02
                                                                                                                              • Opcode Fuzzy Hash: 4a977f273f807b1b63949b441d225898823e1f16fc5fb94c372838013a7a428b
                                                                                                                              • Instruction Fuzzy Hash: 75517A7160418EAFDF008FD8CD80BAE7BF9EB0935CB104526F926D7A52D731D9528B90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A881E0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 150fileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __set_error_mode.LIBCMT ref: 00A88211
                                                                                                                              • __set_error_mode.LIBCMT ref: 00A88222
                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,00A99781,00000104,?,?,00000000), ref: 00A88282
                                                                                                                              • GetStdHandle.KERNEL32(000000F4,774DE0C6,?,00000000,00000003,00000003,?,00A88396,000000FC,00A8B487,?,00A8DAE6,00000018,00A96328,0000000C,00A8DB7C), ref: 00A8832C
                                                                                                                              • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00A8835A
                                                                                                                              Strings
                                                                                                                              • Runtime Error!Program: , xrefs: 00A88245
                                                                                                                              • Microsoft Visual C++ Runtime Library, xrefs: 00A8831A
                                                                                                                              • <program name unknown>, xrefs: 00A8828C
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File__set_error_mode$HandleModuleNameWrite
                                                                                                                              • String ID: <program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                              • API String ID: 3248813247-385325454
                                                                                                                              • Opcode ID: c3ccf79e49396d42675c2c25e3e754a34b7e2360e259566c7df55d5168714c11
                                                                                                                              • Instruction ID: 81a9628102efce3ce6cbc0248dd81d2d02b440902eb96c65b7a61bca33a28297
                                                                                                                              • Opcode Fuzzy Hash: c3ccf79e49396d42675c2c25e3e754a34b7e2360e259566c7df55d5168714c11
                                                                                                                              • Instruction Fuzzy Hash: 893139B2B00614BBEF10B76D5D4AFBF325CDB62B10F850129F80566182FE79D90283B2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09CA30 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 150fileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __set_error_mode.LIBCMT ref: 6C09CA61
                                                                                                                              • __set_error_mode.LIBCMT ref: 6C09CA72
                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,6C0A59D1,00000104,00000000,00000000,00000000,?,6C097C67,00000001,00000214), ref: 6C09CAD2
                                                                                                                              • GetStdHandle.KERNEL32(000000F4,774DE0C6,00000000,00000000,00000003,00000003,?,6C09CBE6,000000FC,6C09B71D,?,6C09AD5E,00000018,6C0A27E8,0000000C,6C09ADF4), ref: 6C09CB7C
                                                                                                                              • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 6C09CBAA
                                                                                                                              Strings
                                                                                                                              • Microsoft Visual C++ Runtime Library, xrefs: 6C09CB6A
                                                                                                                              • <program name unknown>, xrefs: 6C09CADC
                                                                                                                              • Runtime Error!Program: , xrefs: 6C09CA95
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File__set_error_mode$HandleModuleNameWrite
                                                                                                                              • String ID: <program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                              • API String ID: 3248813247-385325454
                                                                                                                              • Opcode ID: 621be5fbcee4ef52f89ed6ad0fb91902fbb6e6150e5a723216914b0392b0514e
                                                                                                                              • Instruction ID: eefb39a17602bb044d73ae7120647e14d12042c70d0a6b993ff1a2aff1a0dbe7
                                                                                                                              • Opcode Fuzzy Hash: 621be5fbcee4ef52f89ed6ad0fb91902fbb6e6150e5a723216914b0392b0514e
                                                                                                                              • Instruction Fuzzy Hash: 23314CB2F052007BDA006AF65C55FDF32EC9B8725CF142125FC0963E42EB21E905A5B2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697483B7 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 75COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _realloc.LIBCMT ref: 69748404
                                                                                                                              • GetPrivateProfileSectionA.KERNEL32 ref: 69748419
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$PrivateProfileSection_realloc_strrchr
                                                                                                                              • String ID: LoadListFromInfSection$LoadListFromInfSection(): Unable to load %s - [%s].$Unable to allocate memory.$Unable to find %s$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h$realloc()
                                                                                                                              • API String ID: 2994852080-3670691587
                                                                                                                              • Opcode ID: 8541ae407e32b0c49e295f18977ba26240e085527dfc7bb863ff7928a6179068
                                                                                                                              • Instruction ID: b6c31cae19daacec46257b3f160512de2d625b5360ceb53b1d15bd7feda7ae67
                                                                                                                              • Opcode Fuzzy Hash: 8541ae407e32b0c49e295f18977ba26240e085527dfc7bb863ff7928a6179068
                                                                                                                              • Instruction Fuzzy Hash: 47110876508209BFEB002F558E84D9E77A9EF65B987508439FE44A5143EB719A208AA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A86B31 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 73COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _memset.LIBCMT ref: 00A86B43
                                                                                                                              • GetFileVersionInfoSizeA.VERSION(?,00A86A7D,?,\comctl32.dll,?,00A86A7D,?,?), ref: 00A86B52
                                                                                                                              • _memset.LIBCMT ref: 00A86B72
                                                                                                                              • GetFileVersionInfoA.VERSION(?,00000000,00000000,00000000,00000000,?,00A86A7D,?,\comctl32.dll,?,00A86A7D,?,?), ref: 00A86B80
                                                                                                                              • VerQueryValueA.VERSION(00000000,00A81310,?,?,?,00000000,00000000,00000000,00000000,?,00A86A7D,?,\comctl32.dll,?,00A86A7D,?), ref: 00A86B97
                                                                                                                              • _memcpy_s.LIBCMT ref: 00A86BCB
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileInfoVersion_memset$QuerySizeValue_memcpy_s
                                                                                                                              • String ID: 4$\comctl32.dll
                                                                                                                              • API String ID: 59702410-3030107532
                                                                                                                              • Opcode ID: 2c3d77a88499573fb2a88ab36a60016a48356f21da964c597abc380c695af9f8
                                                                                                                              • Instruction ID: 30997254319cba7190d8da93ced7ccdc0be69cd452fc3788f0f27ec03c961511
                                                                                                                              • Opcode Fuzzy Hash: 2c3d77a88499573fb2a88ab36a60016a48356f21da964c597abc380c695af9f8
                                                                                                                              • Instruction Fuzzy Hash: 9C11C272545108BEEF117A649D8ACBF3B6C9F52798F204075FA05A6042EA218E46E3A1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0941C4 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DirectXLoadString.DSETUP32(00001391,?,DirectXDeviceDriverSetupA()), ref: 6C094208
                                                                                                                              • DirectXSetupCallback.DSETUP32(0000000A,00000010,?,00000000,00000000), ref: 6C09421D
                                                                                                                              • DestroyWindow.USER32 ref: 6C09422D
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C094238
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C096506
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C09650F
                                                                                                                                • Part of subcall function 6C0964D5: _strrchr.LIBCMT ref: 6C096555
                                                                                                                              Strings
                                                                                                                              • DirectXDeviceDriverSetupA(), xrefs: 6C0941DD
                                                                                                                              • DirectXDeviceDriverSetupA, xrefs: 6C094244
                                                                                                                              • DestroyWindow(), xrefs: 6C09423F
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c, xrefs: 6C09424E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Direct__wstrtime$CallbackDestroyErrorLastLoadSetupStringWindow_strrchr
                                                                                                                              • String ID: DestroyWindow()$DirectXDeviceDriverSetupA$DirectXDeviceDriverSetupA()$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 3711049222-1816451749
                                                                                                                              • Opcode ID: 7022663f9718808fdb1e18573a5405a276cf7f40d919e6806f2f778b406bd92e
                                                                                                                              • Instruction ID: 26b3ce3f3ba2be45b24d0c376a06bfde7696eadd64f0cb457165321cb9289dc7
                                                                                                                              • Opcode Fuzzy Hash: 7022663f9718808fdb1e18573a5405a276cf7f40d919e6806f2f778b406bd92e
                                                                                                                              • Instruction Fuzzy Hash: 5F11AC75B00914BBDB009FA5AC04FEE3BFCBB0A700F401405F65AE7681CBB0AA409BD1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C094278 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DirectXLoadString.DSETUP32(00001391,?,DirectXDeviceDriverSetupW()), ref: 6C0942BC
                                                                                                                              • DirectXSetupCallback.DSETUP32(0000000A,00000010,?,00000000,00000000), ref: 6C0942D1
                                                                                                                              • DestroyWindow.USER32 ref: 6C0942E1
                                                                                                                              • GetLastError.KERNEL32(00000000), ref: 6C0942EC
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C096506
                                                                                                                                • Part of subcall function 6C0964D5: __wstrtime.LIBCMT ref: 6C09650F
                                                                                                                                • Part of subcall function 6C0964D5: _strrchr.LIBCMT ref: 6C096555
                                                                                                                              Strings
                                                                                                                              • DirectXDeviceDriverSetupW(), xrefs: 6C094291
                                                                                                                              • DirectXDeviceDriverSetupW, xrefs: 6C0942F8
                                                                                                                              • DestroyWindow(), xrefs: 6C0942F3
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c, xrefs: 6C094302
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Direct__wstrtime$CallbackDestroyErrorLastLoadSetupStringWindow_strrchr
                                                                                                                              • String ID: DestroyWindow()$DirectXDeviceDriverSetupW$DirectXDeviceDriverSetupW()$e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c
                                                                                                                              • API String ID: 3711049222-3655650028
                                                                                                                              • Opcode ID: 7e10264e9523205ef7df8bef8c39550d9342e94be21f52cdbc0f5ec884bb1f37
                                                                                                                              • Instruction ID: dc65105ab25e0fa3fa495bea7ad0c47e4511068580dd55874596ff6e869b49e2
                                                                                                                              • Opcode Fuzzy Hash: 7e10264e9523205ef7df8bef8c39550d9342e94be21f52cdbc0f5ec884bb1f37
                                                                                                                              • Instruction Fuzzy Hash: FF11AC75B04914BBDB009FE5DC04FDE3BF8AB0A700F001405F55AE7681CBB0AA409BD1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6975134E Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 46libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,6975B4B8,0000000C,69751467,00000000,00000000,?,?,6974FCAF,69747D8D,?,?,6974770E,00066BDC), ref: 6975135F
                                                                                                                              • GetProcAddress.KERNEL32(00000000,EncodePointer,?,?,6974FCAF,69747D8D), ref: 69751388
                                                                                                                              • GetProcAddress.KERNEL32(?,DecodePointer,?,?,6974FCAF,69747D8D), ref: 69751398
                                                                                                                              • InterlockedIncrement.KERNEL32(6975D950), ref: 697513BA
                                                                                                                              • ___addlocaleref.LIBCMT ref: 697513E1
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref
                                                                                                                              • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                              • API String ID: 1389861978-2843748187
                                                                                                                              • Opcode ID: ca41b7d833197ffaa40a9eedde7d77128a10b72593ae282b73da223a9be41630
                                                                                                                              • Instruction ID: 833e19e790d2965758d35711c02a12426ee2aba6cf22951e1fab26d0c9b55800
                                                                                                                              • Opcode Fuzzy Hash: ca41b7d833197ffaa40a9eedde7d77128a10b72593ae282b73da223a9be41630
                                                                                                                              • Instruction Fuzzy Hash: C411A074840701DFDBA0DF39CA44B5ABBE0EF00304F00842AD4AAD3290DF749A50DF24
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A88E07 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 46libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetModuleHandleA.KERNEL32(KERNEL32.DLL,00A96140,0000000C,00A88F20,00000000,00000000,?,00A8988D,?,?,?,00000000), ref: 00A88E18
                                                                                                                              • GetProcAddress.KERNEL32(00000000,EncodePointer,?,00A8988D,?,?,?,00000000), ref: 00A88E41
                                                                                                                              • GetProcAddress.KERNEL32(?,DecodePointer,?,00A8988D,?,?,?,00000000), ref: 00A88E51
                                                                                                                              • InterlockedIncrement.KERNEL32(00A985D0), ref: 00A88E73
                                                                                                                              • ___addlocaleref.LIBCMT ref: 00A88E9A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref
                                                                                                                              • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                              • API String ID: 1389861978-2843748187
                                                                                                                              • Opcode ID: 48f33c53bd6658e3c64e93d6ba78f4547cbbccdb7844616e660db5867c145f8e
                                                                                                                              • Instruction ID: f0c2ad47682b7f60893bc28b8dc59b63307e0b15de6414199933a12febd4ae3e
                                                                                                                              • Opcode Fuzzy Hash: 48f33c53bd6658e3c64e93d6ba78f4547cbbccdb7844616e660db5867c145f8e
                                                                                                                              • Instruction Fuzzy Hash: 8B115E71940701AEDB10FFB5DD45B6ABBE4AF04314F10491AE499D7690DBB8D941CF11
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69759FD3 Relevance: 13.7, APIs: 9, Instructions: 178COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,69759B1F,00000001,?,00000000,?,?,?), ref: 6975A01E
                                                                                                                              • GetCPInfo.KERNEL32(?,00000001,?,69759B1F,00000001,?), ref: 6975A037
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,69759B1F,00000000,00000000,?,69759B1F,00000001,?,00000000,?,?,?,?,00000000), ref: 6975A09B
                                                                                                                              • _memset.LIBCMT ref: 6975A0D3
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,69759B1F,?,00000000,?,?,?,?,?,?,?,69759B1F,00000001,?), ref: 6975A0EA
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,69759B1F), ref: 6975A105
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,69759B1F), ref: 6975A12B
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,69759B1F), ref: 6975A150
                                                                                                                              • __freea.LIBCMT ref: 6975A172
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$Info$__freea_memset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1700608584-0
                                                                                                                              • Opcode ID: 98b76cee16d93a059392bf9b555be40e4c93409e8a977a4751854abc4383c4fc
                                                                                                                              • Instruction ID: c91d4a1c1553153b7b3c076ba224bc848c0234ac137398b2dcdf186bd0e4359a
                                                                                                                              • Opcode Fuzzy Hash: 98b76cee16d93a059392bf9b555be40e4c93409e8a977a4751854abc4383c4fc
                                                                                                                              • Instruction Fuzzy Hash: 59516971D00259AFDF449F94CE849EEBBB9EB083A4F104139E91AE7150EB319D61CBB0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A91343 Relevance: 13.7, APIs: 9, Instructions: 178COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,00A90F03,00000001,?,00000000,?,?,?), ref: 00A9138E
                                                                                                                              • GetCPInfo.KERNEL32(?,00000001,?,00A90F03,00000001,?), ref: 00A913A7
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,00A90F03,00000000,00000000,?,00A90F03,00000001,?,00000000,?,?,?,?,00000000), ref: 00A9140B
                                                                                                                              • _memset.LIBCMT ref: 00A91443
                                                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,00A90F03,?,00000000,?,?,?,?,?,?,?,00A90F03,00000001,?), ref: 00A9145A
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00A90F03), ref: 00A91475
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00A90F03), ref: 00A9149B
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00A90F03), ref: 00A914C0
                                                                                                                              • __freea.LIBCMT ref: 00A914E2
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$Info$__freea_memset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1700608584-0
                                                                                                                              • Opcode ID: c6f0a0d89082788c1bf7a38bfb400d23c7e401f80d4593ed93dabeaf71604311
                                                                                                                              • Instruction ID: edecfc8f730caf07a1179d81bdd2056e076aac3191d2780d50d05e43754eea69
                                                                                                                              • Opcode Fuzzy Hash: c6f0a0d89082788c1bf7a38bfb400d23c7e401f80d4593ed93dabeaf71604311
                                                                                                                              • Instruction Fuzzy Hash: 53515AB1E0011AAFDF20AF95DD848EEBBFAEF48364F154529F514A7260D7319D42CBA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69759930 Relevance: 13.7, APIs: 9, Instructions: 166COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetStringTypeW.KERNEL32(00000001,69744E80,00000001,?,?,?,00000000,?,?,?,69759B1F,00000001,?,00000000,?,?), ref: 6975995F
                                                                                                                              • GetLastError.KERNEL32(?,69759B1F,00000001,?,00000000,?,?,?,?,00000000,?,00000001,00000000,00000000,00000008,?), ref: 69759971
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,00000000,?,?,?,69759B1F,00000001,?,00000000), ref: 697599D6
                                                                                                                              • _memset.LIBCMT ref: 69759A2B
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,00000000,?,00000001,00000000,00000000,00000008,?,00000000), ref: 69759A40
                                                                                                                              • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 69759A4E
                                                                                                                              • __freea.LIBCMT ref: 69759A58
                                                                                                                              • ___ansicp.LIBCMT ref: 69759A82
                                                                                                                              • GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,69759B1F,00000001,?,00000000,?), ref: 69759AC3
                                                                                                                                • Part of subcall function 69759FD3: GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,69759B1F,00000001,?,00000000,?,?,?), ref: 6975A01E
                                                                                                                                • Part of subcall function 69759FD3: GetCPInfo.KERNEL32(?,00000001,?,69759B1F,00000001,?), ref: 6975A037
                                                                                                                                • Part of subcall function 69759FD3: _memset.LIBCMT ref: 6975A0D3
                                                                                                                                • Part of subcall function 69759FD3: MultiByteToWideChar.KERNEL32(?,00000001,?,69759B1F,?,00000000,?,?,?,?,?,?,?,69759B1F,00000001,?), ref: 6975A0EA
                                                                                                                                • Part of subcall function 69759FD3: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,69759B1F), ref: 6975A105
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$StringType$Info_memset$ErrorLast___ansicp__freea
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3793715485-0
                                                                                                                              • Opcode ID: 62ce341d0bd25802814322cb9427bf1e9389d861a7f9c02c06027401486462a2
                                                                                                                              • Instruction ID: 29f79637de7a741d5497f7e0557eccd471331838fe696abc78d5458d27b48028
                                                                                                                              • Opcode Fuzzy Hash: 62ce341d0bd25802814322cb9427bf1e9389d861a7f9c02c06027401486462a2
                                                                                                                              • Instruction Fuzzy Hash: CF519CB590014AEFEF80EF54CE869AA7BA9FB55394B50403AF916D7250DF30C970CBA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A90D14 Relevance: 13.7, APIs: 9, Instructions: 166COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetStringTypeW.KERNEL32(00000001,00A82A18,00000001,?,?,?,00000000,?,?,?,00A90F03,00000001,?,00000000,?,?), ref: 00A90D43
                                                                                                                              • GetLastError.KERNEL32(?,00A90F03,00000001,?,00000000,?,?,?,?,00000000,?,00000001,00000000,00000000,00000008,?), ref: 00A90D55
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,00000000,?,?,?,00A90F03,00000001,?,00000000), ref: 00A90DBA
                                                                                                                              • _memset.LIBCMT ref: 00A90E0F
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,00000000,?,00000001,00000000,00000000,00000008,?,00000000), ref: 00A90E24
                                                                                                                              • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00A90E32
                                                                                                                              • __freea.LIBCMT ref: 00A90E3C
                                                                                                                              • ___ansicp.LIBCMT ref: 00A90E66
                                                                                                                              • GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,00A90F03,00000001,?,00000000,?), ref: 00A90EA7
                                                                                                                                • Part of subcall function 00A91343: GetCPInfo.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,00A90F03,00000001,?,00000000,?,?,?), ref: 00A9138E
                                                                                                                                • Part of subcall function 00A91343: GetCPInfo.KERNEL32(?,00000001,?,00A90F03,00000001,?), ref: 00A913A7
                                                                                                                                • Part of subcall function 00A91343: _memset.LIBCMT ref: 00A91443
                                                                                                                                • Part of subcall function 00A91343: MultiByteToWideChar.KERNEL32(?,00000001,?,00A90F03,?,00000000,?,?,?,?,?,?,?,00A90F03,00000001,?), ref: 00A9145A
                                                                                                                                • Part of subcall function 00A91343: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00A90F03), ref: 00A91475
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$StringType$Info_memset$ErrorLast___ansicp__freea
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3793715485-0
                                                                                                                              • Opcode ID: 4efc9add9b94cbea1416a018803d0582588c0bc211f55393733a67fc11f9b71b
                                                                                                                              • Instruction ID: fc1ee918cacea940c8b2df80316d1001b4f61a445ed8f053bfbfe0f611f17096
                                                                                                                              • Opcode Fuzzy Hash: 4efc9add9b94cbea1416a018803d0582588c0bc211f55393733a67fc11f9b71b
                                                                                                                              • Instruction Fuzzy Hash: 0E518D7560020AEFDF20DF98DC85DAE7BE9EB18390B24492AF915C7160D730DD919BA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69755624 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 131COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: String___crt$InfoType_memset
                                                                                                                              • String ID: $.Zui
                                                                                                                              • API String ID: 406800760-3318680181
                                                                                                                              • Opcode ID: 330d0288f2209b67687de2aecc56963f25ead42eac26acd7309a672f19b2458d
                                                                                                                              • Instruction ID: 0f0f7b7ca6c4b1f83157564099947189bbcdcefe9136ac38fa5db784cf02b845
                                                                                                                              • Opcode Fuzzy Hash: 330d0288f2209b67687de2aecc56963f25ead42eac26acd7309a672f19b2458d
                                                                                                                              • Instruction Fuzzy Hash: 7C41157450079CDEDB618B24DE84BFB7BF8EB41708F1448E8D59BC6092DA719B558F10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974E3C4 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 110COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _memset.LIBCMT ref: 6974E4A7
                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104,?,dxupdate.cab,?), ref: 6974E4D1
                                                                                                                              • GetLastError.KERNEL32(00000000,?,dxupdate.cab,?), ref: 6974E4DC
                                                                                                                              Strings
                                                                                                                              • CSetup::DXCheckTrust, xrefs: 6974E4E8
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp, xrefs: 6974E4F2
                                                                                                                              • dxupdate.cab, xrefs: 6974E467
                                                                                                                              • MultiByteToWideChar(), xrefs: 6974E4E3
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharErrorLastMultiWide_memset
                                                                                                                              • String ID: CSetup::DXCheckTrust$MultiByteToWideChar()$dxupdate.cab$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 1545292163-2608571884
                                                                                                                              • Opcode ID: 95459e429cea5d8c7eedcd5ff59c8844798810fb067d4db9e49ef2cc3718a21c
                                                                                                                              • Instruction ID: f55b71d7a90a1752e19ce467dd78b41b05e62201fd8d13d0142719cb9bc218f5
                                                                                                                              • Opcode Fuzzy Hash: 95459e429cea5d8c7eedcd5ff59c8844798810fb067d4db9e49ef2cc3718a21c
                                                                                                                              • Instruction Fuzzy Hash: 11416BB1A4424C9FD711CF688E49AF97B74BF01A28F0005EAA505BA0B3D7358A178B86
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69749B63 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 100COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _strnlen
                                                                                                                              • String ID: , $Invalid parameger.$MakeForceCopyList$MakeForceCopyList(): Unable to get file name.$Unable to allocate memory block.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h
                                                                                                                              • API String ID: 263284996-911860730
                                                                                                                              • Opcode ID: 779e694c95c2440036722dbfa746359e21cd2c65cfa3d3ac818763f8a5d3717a
                                                                                                                              • Instruction ID: 7fe89b80ebe3308a29714145d5eddc08e7d2a37b844d6b552f39aedc1496e19d
                                                                                                                              • Opcode Fuzzy Hash: 779e694c95c2440036722dbfa746359e21cd2c65cfa3d3ac818763f8a5d3717a
                                                                                                                              • Instruction Fuzzy Hash: 763101B1A84205BEE7109B608F45F9A7BD8EF62F54F508439E904EA183FB30D610C6A4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A85AFD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 77COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00A85B38
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectorySystem
                                                                                                                              • String ID: DXGetFileVersion() failed.$FRunningOnWinXP$GetSystemDirectory()$\ntkrnlpa.exe$e:\bt\382730\setup\deliverables\dxsetup\psheets.h
                                                                                                                              • API String ID: 2188284642-4260967288
                                                                                                                              • Opcode ID: caa0814726b58a03e89eac9b733409f4374e4287327da36ecc92e300f4d5b10b
                                                                                                                              • Instruction ID: 2feff000fc48eddb19f28e8089db572afd9ec1e344f15777b2a997a62459a775
                                                                                                                              • Opcode Fuzzy Hash: caa0814726b58a03e89eac9b733409f4374e4287327da36ecc92e300f4d5b10b
                                                                                                                              • Instruction Fuzzy Hash: 6821A171E05628ABCB20F7B58D49FDB36BCAF15790F500466B845E2080EEB4DE46CBA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974AE99 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 75COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _realloc.LIBCMT ref: 6974AEE6
                                                                                                                              • GetPrivateProfileSectionNamesA.KERNEL32(00000000,-00000258,?), ref: 6974AEF8
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$NamesPrivateProfileSection_realloc_strrchr
                                                                                                                              • String ID: GetSectionNamesFromInf$GetSectionNamesFromInf(): Unable to get section names from %s.$Unable to find %s$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h$realloc()
                                                                                                                              • API String ID: 14898424-1451593648
                                                                                                                              • Opcode ID: 7f41ced4683deb8a40bc2d60295302564a8c6afe8d1c2b6ad206cc20d6442999
                                                                                                                              • Instruction ID: 25645920c17eaee13b4d832d36086bf9e3b43551df6104d07ae543cc5894c613
                                                                                                                              • Opcode Fuzzy Hash: 7f41ced4683deb8a40bc2d60295302564a8c6afe8d1c2b6ad206cc20d6442999
                                                                                                                              • Instruction Fuzzy Hash: 641127B550C2087FEB002EA48FC4E5A37ACEF61FB87504539FA54E5183EB31DE644664
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69746F9C Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 73COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 69746FD8
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectorySystem
                                                                                                                              • String ID: DXGetFileVersion() failed.$FRunningOnLH$GetSystemDirectory()$\ntkrnlpa.exe$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h
                                                                                                                              • API String ID: 2188284642-910728970
                                                                                                                              • Opcode ID: 4d9026f8de2ec1a2e3d84f66545e7645c3764a31874f6a40c2ec5480734154ad
                                                                                                                              • Instruction ID: f9e22657adfc944263d49ceab79c865fff311e526e1c8a020fe31221092ed653
                                                                                                                              • Opcode Fuzzy Hash: 4d9026f8de2ec1a2e3d84f66545e7645c3764a31874f6a40c2ec5480734154ad
                                                                                                                              • Instruction Fuzzy Hash: EA210375A41248ABDFA0EA74CE44FDA33AC9B5AF54F404476F105E2093EB70DB84CB24
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A85BFA Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00A85C35
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectorySystem
                                                                                                                              • String ID: DXGetFileVersion() failed.$FRunningOnNETServer$GetSystemDirectory()$\ntkrnlpa.exe$e:\bt\382730\setup\deliverables\dxsetup\psheets.h
                                                                                                                              • API String ID: 2188284642-1925970428
                                                                                                                              • Opcode ID: 1016028b5262f32dc2bb98fc90fdbb5bd04d07098128430a6ac27b13773fe38f
                                                                                                                              • Instruction ID: a89672ebe10c022f9c823d87d18e755398e48f2a26d23532e777f2d90b20e76d
                                                                                                                              • Opcode Fuzzy Hash: 1016028b5262f32dc2bb98fc90fdbb5bd04d07098128430a6ac27b13773fe38f
                                                                                                                              • Instruction Fuzzy Hash: F51172B1E01724ABCB60FBB59D4AFEA76ACAB05750F100566B905E2180EF78DE45CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6975A6C6 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___initconout.LIBCMT ref: 6975A6EC
                                                                                                                                • Part of subcall function 6975B2C3: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000), ref: 6975B2D6
                                                                                                                              • WriteConsoleW.KERNEL32 ref: 6975A70D
                                                                                                                              • GetLastError.KERNEL32(?,?,69756CEC,?), ref: 6975A720
                                                                                                                              • GetConsoleOutputCP.KERNEL32 ref: 6975A740
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,?,?,69756CEC,?), ref: 6975A747
                                                                                                                              • WriteConsoleA.KERNEL32(FFFFFFFE,?,00000000,?,00000000), ref: 6975A763
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide___initconout
                                                                                                                              • String ID: lui
                                                                                                                              • API String ID: 3734994816-213149565
                                                                                                                              • Opcode ID: 7a3cd4f40e296f257e81e5f3431e9cca3878e67e82f1d5fcff333343b975feaa
                                                                                                                              • Instruction ID: 388d7a6cad99f9386b6ffe566670b8d9b632d10b8833ce5a4991817d9110acb5
                                                                                                                              • Opcode Fuzzy Hash: 7a3cd4f40e296f257e81e5f3431e9cca3878e67e82f1d5fcff333343b975feaa
                                                                                                                              • Instruction Fuzzy Hash: 14219D30900149FFDB84EFA0CA49EFA3BB8EF42764B104A39F512C6094DF309555CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974691D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetVersionExA.KERNEL32(?), ref: 6974695B
                                                                                                                              • LoadLibraryA.KERNEL32(ntdll.dll), ref: 69746979
                                                                                                                              • GetProcAddress.KERNEL32(00000000,NtQueryInformationProcess,00000000), ref: 6974698C
                                                                                                                              • GetCurrentProcess.KERNEL32(0000001A,00000000,00000004,00000000), ref: 697469AC
                                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 697469CD
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Library$AddressCurrentFreeLoadProcProcessVersion
                                                                                                                              • String ID: NtQueryInformationProcess$ntdll.dll
                                                                                                                              • API String ID: 3451282406-2906145389
                                                                                                                              • Opcode ID: 7355a3f1c45f74935c4b0d1a7ce8296a82aa1037fcd79901397ab5012315a101
                                                                                                                              • Instruction ID: 6ea8faee6bed3f70d31dadc0598b14e0985c1a20fa9e812f8068166c2a04bdc5
                                                                                                                              • Opcode Fuzzy Hash: 7355a3f1c45f74935c4b0d1a7ce8296a82aa1037fcd79901397ab5012315a101
                                                                                                                              • Instruction Fuzzy Hash: 70218431A01255DBDF90EB34CA49BAA77B4AB46B25F10017AE529D21C2EB708A85CF15
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A84570 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 62windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastLoadMessageString
                                                                                                                              • String ID: DSetupCallback$DirectX Setup$LoadString()$e:\bt\382730\setup\deliverables\dxsetup\dxsetup.cpp
                                                                                                                              • API String ID: 2128103774-4186389697
                                                                                                                              • Opcode ID: 74c55d946a90304217c95f11bda91f88edf2ccad7f0c7bab00c3279c8f823db4
                                                                                                                              • Instruction ID: 38319c036b631f1d096bf1f4bc06728a99b6446325687603ffdb6453eb6ad7d4
                                                                                                                              • Opcode Fuzzy Hash: 74c55d946a90304217c95f11bda91f88edf2ccad7f0c7bab00c3279c8f823db4
                                                                                                                              • Instruction Fuzzy Hash: 5B11A072A00209BBCB10FBA49C41DFE77BCFB49714F10443AFA45E2041FA758D469B20
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A855B2 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 46windowthreadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetParent.USER32 ref: 00A855CC
                                                                                                                              • PostMessageA.USER32 ref: 00A855D3
                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_0000554D,?,00000000,?), ref: 00A855E6
                                                                                                                              • GetLastError.KERNEL32(00000000,?,00000000,?), ref: 00A855F4
                                                                                                                              Strings
                                                                                                                              • e:\bt\382730\setup\deliverables\dxsetup\psheets.cpp, xrefs: 00A8560A
                                                                                                                              • CreateThread(), xrefs: 00A855FB
                                                                                                                              • CDXWSetup::Install, xrefs: 00A85600
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CreateErrorLastMessageParentPostThread
                                                                                                                              • String ID: CDXWSetup::Install$CreateThread()$e:\bt\382730\setup\deliverables\dxsetup\psheets.cpp
                                                                                                                              • API String ID: 3016392610-3077047923
                                                                                                                              • Opcode ID: 82002c5e72a4d20894063f35809c4979e136332c3c64213145bdda1b11b7135b
                                                                                                                              • Instruction ID: cfcdb2b8e0fdcb102ce2954b09b4e574994e98885bcd1dac0d4ba68e3b12acec
                                                                                                                              • Opcode Fuzzy Hash: 82002c5e72a4d20894063f35809c4979e136332c3c64213145bdda1b11b7135b
                                                                                                                              • Instruction Fuzzy Hash: 31F09072E906407BD720B7B69C0DC3B3A7DE7C6F61714092ABA46D2040E7A0894387B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69749532 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 697467A1: GetFileVersionInfoSizeA.VERSION(69746892,?,\ntkrnlpa.exe,00000104,00000000,?,?,69746892,?,?,?,00000000), ref: 697467B2
                                                                                                                                • Part of subcall function 697467A1: GetLastError.KERNEL32(69746892,69746892,?,\ntkrnlpa.exe,00000104,00000000,?,?,69746892,?,?,?,00000000), ref: 697467C9
                                                                                                                              • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?), ref: 69749558
                                                                                                                              • GetLastError.KERNEL32(Unable to get Translation valie.,00000000,\VarFileInfo\Translation,?,?,?), ref: 69749566
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              • VerQueryValue(), xrefs: 6974956D
                                                                                                                              • \VarFileInfo\Translation, xrefs: 69749552
                                                                                                                              • Unable to get Translation valie., xrefs: 69749561
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 6974957C
                                                                                                                              • GetLangCodePage, xrefs: 69749572
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLast__wstrtime$FileInfoQuerySizeValueVersion_strrchr
                                                                                                                              • String ID: GetLangCodePage$Unable to get Translation valie.$VerQueryValue()$\VarFileInfo\Translation$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 2263350259-635172172
                                                                                                                              • Opcode ID: 79902ae866eff7737bc90874983cc36207d4f3ce9b529c857b3cfe758cf17866
                                                                                                                              • Instruction ID: eb6b2de578baefe2139d64fdbdc6525ff1df64720b978ef4639bba83211cebb0
                                                                                                                              • Opcode Fuzzy Hash: 79902ae866eff7737bc90874983cc36207d4f3ce9b529c857b3cfe758cf17866
                                                                                                                              • Instruction Fuzzy Hash: F3F0AF36500114BB9702AA66CF48CEF779CDFDAF587908021F905DA142EB30EB2286A1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A88A65 Relevance: 10.7, APIs: 7, Instructions: 184COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetStartupInfoA.KERNEL32 ref: 00A88A7A
                                                                                                                                • Part of subcall function 00A8E40D: __calloc_impl.LIBCMT ref: 00A8E422
                                                                                                                              • GetFileType.KERNEL32 ref: 00A88B88
                                                                                                                              • ___crtInitCritSecAndSpinCount.LIBCMT ref: 00A88BBC
                                                                                                                              • GetStdHandle.KERNEL32(-000000F6), ref: 00A88C13
                                                                                                                              • GetFileType.KERNEL32 ref: 00A88C25
                                                                                                                              • ___crtInitCritSecAndSpinCount.LIBCMT ref: 00A88C53
                                                                                                                              • SetHandleCount.KERNEL32 ref: 00A88C7E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Count$CritFileHandleInitSpinType___crt$InfoStartup__calloc_impl
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3691444693-0
                                                                                                                              • Opcode ID: 0cfdc40d3268601b9108294dd59263d4bfa5107cae49f94abae8fec76d2cf853
                                                                                                                              • Instruction ID: 4899f30960b3231640b04df937fa514439845b233cb908d73b06dd99429013fa
                                                                                                                              • Opcode Fuzzy Hash: 0cfdc40d3268601b9108294dd59263d4bfa5107cae49f94abae8fec76d2cf853
                                                                                                                              • Instruction Fuzzy Hash: 0D6136B16043418FC724EB68D98C719BBE0BF42724F688759D5629B2E0CF3CD846CB21
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8BB2D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: String___crt$InfoType_memset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 406800760-3916222277
                                                                                                                              • Opcode ID: b926ceffb82227fc895e115dbb4d8f4677b03ae69bfab45ecd4b813ad7140606
                                                                                                                              • Instruction ID: 483e9f154da34c421c30c66610163efa4491b3251c5dd106d4c9dbd89f947bb1
                                                                                                                              • Opcode Fuzzy Hash: b926ceffb82227fc895e115dbb4d8f4677b03ae69bfab45ecd4b813ad7140606
                                                                                                                              • Instruction Fuzzy Hash: D44107B150079C9EDB359B248C89FFB7BF8AF05704F1444E8E59687082D7719A459F60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09D48C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: String___crt$InfoType_memset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 406800760-3916222277
                                                                                                                              • Opcode ID: d2020a685b64416a4abef93b19879b6bd9e3b51cff6c5fcb3f267876cc71acf0
                                                                                                                              • Instruction ID: a98b6a987808c0766242ff7d667b14c24cc28c978cf3e1ec4563bf94cc9a3ea5
                                                                                                                              • Opcode Fuzzy Hash: d2020a685b64416a4abef93b19879b6bd9e3b51cff6c5fcb3f267876cc71acf0
                                                                                                                              • Instruction Fuzzy Hash: BC41367054475C9EEB218F68CC84BFB7BFCAB0630CF1454E8D59A83582D2719A459F50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974BA00 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CharLowerA.USER32 ref: 6974BA17
                                                                                                                              • _strrchr.LIBCMT ref: 6974BA31
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp, xrefs: 6974BA64
                                                                                                                              • Unable to create path string, %s%s., xrefs: 6974BA53
                                                                                                                              • CSetup::CheckProgramFiles, xrefs: 6974BA5A
                                                                                                                              • \directx\setup\, xrefs: 6974BA1D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime_strrchr$CharLower
                                                                                                                              • String ID: CSetup::CheckProgramFiles$Unable to create path string, %s%s.$\directx\setup\$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 3410477431-2052294242
                                                                                                                              • Opcode ID: e3fc0d51cad694757b8a83ab91031001824716d3b400d626d4481ff7ecd65b1d
                                                                                                                              • Instruction ID: cba8b970ca39f9ed184f6dcfaa3755d58440fab9a63fd0c05e2b0cb0d4b7fbb4
                                                                                                                              • Opcode Fuzzy Hash: e3fc0d51cad694757b8a83ab91031001824716d3b400d626d4481ff7ecd65b1d
                                                                                                                              • Instruction Fuzzy Hash: 3CF0467B38830279F210A0768F4ED2F2B8CDBD2FA8B105036BA19D1043EE25E8118074
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A85A99 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 32libraryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadLibraryA.KERNEL32(?), ref: 00A85AB5
                                                                                                                              • GetLastError.KERNEL32(Unable to load %s.,?), ref: 00A85ACA
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              Strings
                                                                                                                              • Unable to load %s., xrefs: 00A85AC5
                                                                                                                              • LoadLibrary(), xrefs: 00A85AD1
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 00A85AE0
                                                                                                                              • CDllLoader::LoadLibraryA, xrefs: 00A85AD6
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$ErrorLastLibraryLoad_strrchr
                                                                                                                              • String ID: CDllLoader::LoadLibraryA$LoadLibrary()$Unable to load %s.$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 108046663-2531695590
                                                                                                                              • Opcode ID: 59d8599c72de1547532836ead36046e8fd648e80ef4153513d11a53217a5d8c1
                                                                                                                              • Instruction ID: 4bc38e0c93eb820e57581ec2a3db3e64e5ce9b5a2adc548a5611a70a7aa5ebad
                                                                                                                              • Opcode Fuzzy Hash: 59d8599c72de1547532836ead36046e8fd648e80ef4153513d11a53217a5d8c1
                                                                                                                              • Instruction Fuzzy Hash: 09F0A076A80309BBDB14BBE0DC4AC963E9CFB54B927000921FA4A95150E6B1895297A0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69749CD8 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadStringA.USER32 ref: 69749CEA
                                                                                                                              • GetLastError.KERNEL32(Unable to load string, ResID = %d.,?,?,69749E86,?,?,00000258,00000000,?,?), ref: 69749CFE
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp, xrefs: 69749D14
                                                                                                                              • Unable to load string, ResID = %d., xrefs: 69749CF9
                                                                                                                              • CSetup::XLoadString, xrefs: 69749D0A
                                                                                                                              • LoadString(), xrefs: 69749D05
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$ErrorLastLoadString_strrchr
                                                                                                                              • String ID: CSetup::XLoadString$LoadString()$Unable to load string, ResID = %d.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 2420349584-1423309346
                                                                                                                              • Opcode ID: 9d15f78778ae0da39baca79dc4afd7245712d139030ef76d3ce6768be9a0fbca
                                                                                                                              • Instruction ID: 529ff08f36d4e61ff8eb15f2f491e80ec3cbbee49481a90374851be642f56af7
                                                                                                                              • Opcode Fuzzy Hash: 9d15f78778ae0da39baca79dc4afd7245712d139030ef76d3ce6768be9a0fbca
                                                                                                                              • Instruction Fuzzy Hash: 35E01236540599BB8F123ED5DE09DDE3E25EB19F91B448025FE04D5112E632DA319BD0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974F1D3 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 25COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DialogBoxParamA.USER32 ref: 6974F1EF
                                                                                                                              • GetLastError.KERNEL32(Unable to open EULA dialog box.), ref: 6974F1FF
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\setupapi.cpp, xrefs: 6974F212
                                                                                                                              • DirectXSetupShowEULA, xrefs: 6974F20B
                                                                                                                              • Unable to open EULA dialog box., xrefs: 6974F1FA
                                                                                                                              • DialogBox(), xrefs: 6974F206
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$DialogErrorLastParam_strrchr
                                                                                                                              • String ID: DialogBox()$DirectXSetupShowEULA$Unable to open EULA dialog box.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setupapi.cpp
                                                                                                                              • API String ID: 573082458-4027609811
                                                                                                                              • Opcode ID: c7651bacf55402e1269d292feb5bb4dacef4392fc4434d2b2b10a728d1290251
                                                                                                                              • Instruction ID: 30c7ad5c3e5c5667385e500312e58bd6f214489e7e234b3ff563ec2f6d2e38c0
                                                                                                                              • Opcode Fuzzy Hash: c7651bacf55402e1269d292feb5bb4dacef4392fc4434d2b2b10a728d1290251
                                                                                                                              • Instruction Fuzzy Hash: 57E06F322C4248BBD7002F909F0AF1C3A489760F20F800210F304AA0D3EB206A20BA20
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6975ABE7 Relevance: 9.2, APIs: 6, Instructions: 156memoryfileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 69758251: SetFilePointer.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00BFBBEF,697592B8,697592B8,?,69756AD7,00BFBBEF,00000000,00000000,00000002,00000000,00000000), ref: 69758293
                                                                                                                                • Part of subcall function 69758251: GetLastError.KERNEL32(?,69756AD7,00BFBBEF,00000000,00000000,00000002,00000000,00000000,00000002), ref: 697582A0
                                                                                                                                • Part of subcall function 69758251: __dosmaperr.LIBCMT ref: 697582AB
                                                                                                                              • GetProcessHeap.KERNEL32(00000008,00001000,?,?,?,?,?,00000000,00000109,00000000,?,?,6975907D,00000109,69747D8D), ref: 6975AC50
                                                                                                                              • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000,00000109,00000000,?,?,6975907D,00000109,69747D8D), ref: 6975AC57
                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,6975907D), ref: 6975ACD3
                                                                                                                              • HeapFree.KERNEL32(00000000), ref: 6975ACDA
                                                                                                                              • SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,6975907D), ref: 6975AD35
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,6975907D,00000109), ref: 6975AD62
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Heap$ErrorFileLastProcess$AllocFreePointer__dosmaperr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3789379547-0
                                                                                                                              • Opcode ID: 52dd76892acb5a4e2200ea84c6cea220eede9ecc156ef0865eefd53765a7a57a
                                                                                                                              • Instruction ID: bb13aa53bf66858e12c546ef3be911392a71fde9dfc6cdcfe077580f59249b61
                                                                                                                              • Opcode Fuzzy Hash: 52dd76892acb5a4e2200ea84c6cea220eede9ecc156ef0865eefd53765a7a57a
                                                                                                                              • Instruction Fuzzy Hash: 7341D476900509AFDF89AFB8CE4569D3A65FB00374F108735F927A71A0EF35897187A0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0A14CE Relevance: 9.2, APIs: 6, Instructions: 156memoryfileCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 6C09DBF5: SetFilePointer.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00BFBBEF,6C09FD67,6C09FD67,?,6C09DE82,00BFBBEF,00000000,00000000,00000002,00000000,00000000), ref: 6C09DC37
                                                                                                                                • Part of subcall function 6C09DBF5: GetLastError.KERNEL32(?,6C09DE82,00BFBBEF,00000000,00000000,00000002,00000000,00000000,00000002), ref: 6C09DC44
                                                                                                                                • Part of subcall function 6C09DBF5: __dosmaperr.LIBCMT ref: 6C09DC4F
                                                                                                                              • GetProcessHeap.KERNEL32(00000008,00001000,?,?,?,?,?,00000000,00000109,00000000,?,?,6C09FB2C,00000109,00000000), ref: 6C0A1537
                                                                                                                              • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000,00000109,00000000,?,?,6C09FB2C,00000109,00000000), ref: 6C0A153E
                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,6C09FB2C), ref: 6C0A15BA
                                                                                                                              • HeapFree.KERNEL32(00000000), ref: 6C0A15C1
                                                                                                                              • SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,6C09FB2C), ref: 6C0A161C
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000109,00000000,?,?,6C09FB2C,00000109), ref: 6C0A1649
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Heap$ErrorFileLastProcess$AllocFreePointer__dosmaperr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3789379547-0
                                                                                                                              • Opcode ID: fbd7b644b152230f049b98202236489e21a1e11bad30c956642d39f3902acbb7
                                                                                                                              • Instruction ID: f7a7a0ad3055dbc158bddb654fdd7c72fa2a955c0d406d7fcc117ab57bba9c71
                                                                                                                              • Opcode Fuzzy Hash: fbd7b644b152230f049b98202236489e21a1e11bad30c956642d39f3902acbb7
                                                                                                                              • Instruction Fuzzy Hash: 1041AD72A00209EFDF101FF8CC4579D3AFAEB41368F145225F929A7AE1DB31D9469B90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697571B4 Relevance: 9.1, APIs: 6, Instructions: 107COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d5dfbd6fa612c9a6baa74b68c86a66c9ee70ae28e65f1d0e753acb4217cfaefb
                                                                                                                              • Instruction ID: 2c9aed6c2fd109b019a4071d4ee6804ab75291271afe3edec87f46a907d92740
                                                                                                                              • Opcode Fuzzy Hash: d5dfbd6fa612c9a6baa74b68c86a66c9ee70ae28e65f1d0e753acb4217cfaefb
                                                                                                                              • Instruction Fuzzy Hash: B43129726057008ED7A08A3ACB45A4677F4AF42374F10DA2DF4BBC7591DF24E562CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A91FEA Relevance: 9.1, APIs: 6, Instructions: 69COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___initconout.LIBCMT ref: 00A92010
                                                                                                                                • Part of subcall function 00A92C72: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000), ref: 00A92C85
                                                                                                                              • WriteConsoleW.KERNEL32 ref: 00A92031
                                                                                                                              • GetLastError.KERNEL32(?,?,00A8F195,?), ref: 00A92044
                                                                                                                              • GetConsoleOutputCP.KERNEL32 ref: 00A92064
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,?,?,00A8F195,?), ref: 00A9206B
                                                                                                                              • WriteConsoleA.KERNEL32(FFFFFFFE,?,00000000,?,00000000), ref: 00A92087
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide___initconout
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3734994816-0
                                                                                                                              • Opcode ID: a2c832105fd0fc5583f9ffbb7897a4fb3c40f59c3fb4b5cdf36014ac0335ddf9
                                                                                                                              • Instruction ID: 08a2c147cb9e0de0f32084bcfa50133cb746b406d5ba72e448f71f4cddeefdf6
                                                                                                                              • Opcode Fuzzy Hash: a2c832105fd0fc5583f9ffbb7897a4fb3c40f59c3fb4b5cdf36014ac0335ddf9
                                                                                                                              • Instruction Fuzzy Hash: 5D214D75B01214BADF20DBA4DD4CAFB3BBDEB09710B100229F622C6095DF759D46CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0A1299 Relevance: 9.1, APIs: 6, Instructions: 69COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___initconout.LIBCMT ref: 6C0A12BF
                                                                                                                                • Part of subcall function 6C0A2314: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000), ref: 6C0A2327
                                                                                                                              • WriteConsoleW.KERNEL32 ref: 6C0A12E0
                                                                                                                              • GetLastError.KERNEL32(?,?,6C09E097,?), ref: 6C0A12F3
                                                                                                                              • GetConsoleOutputCP.KERNEL32 ref: 6C0A1313
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,?,?,6C09E097,?), ref: 6C0A131A
                                                                                                                              • WriteConsoleA.KERNEL32(FFFFFFFE,?,00000000,?,00000000), ref: 6C0A1336
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide___initconout
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3734994816-0
                                                                                                                              • Opcode ID: ebf00dbb9cb096690b52533c4ea1d1eff008b758ed2b88eaa38ae8dea50ebdad
                                                                                                                              • Instruction ID: 221146a3601f663b5d7c0eb20b2910d49c08b0cb559ebf3c78e26a3c5ad93ab7
                                                                                                                              • Opcode Fuzzy Hash: ebf00dbb9cb096690b52533c4ea1d1eff008b758ed2b88eaa38ae8dea50ebdad
                                                                                                                              • Instruction Fuzzy Hash: 47213875601514FADB10DFE1D808BEE3BFDFB06725B104219FA22C6881EB70D546CBA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A86CFA Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LoadImageA.USER32(00A868CF,00001B5B,00000000,00000000,00000000,00002000), ref: 00A86D1A
                                                                                                                              • CreateCompatibleDC.GDI32(00000000), ref: 00A86D28
                                                                                                                              • SelectObject.GDI32(00000000), ref: 00A86D3C
                                                                                                                              • LoadImageA.USER32(00A868CF,00001B5C,00000000,00000000,00000000,00002000), ref: 00A86D50
                                                                                                                              • CreateCompatibleDC.GDI32(00000000), ref: 00A86D59
                                                                                                                              • SelectObject.GDI32(00000000), ref: 00A86D67
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CompatibleCreateImageLoadObjectSelect
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 301843087-0
                                                                                                                              • Opcode ID: 42bf24cd26bef8dafeae50a5cabe37cbd6eda1e2d002ffdd24b8287da1d5ff1f
                                                                                                                              • Instruction ID: 85b66c9fe3afa6fb3d96a55b84c0d56f9e858822714e2a6dc290b6d8001f72af
                                                                                                                              • Opcode Fuzzy Hash: 42bf24cd26bef8dafeae50a5cabe37cbd6eda1e2d002ffdd24b8287da1d5ff1f
                                                                                                                              • Instruction Fuzzy Hash: 9BF0FFB16003547EEB109FE6AC89E677F7EE7C5750B00441BFB0487160DE755802CB60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A86D75 Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DeleteObject.GDI32(00000000), ref: 00A86D89
                                                                                                                              • DeleteObject.GDI32(00000000), ref: 00A86D9B
                                                                                                                              • DeleteObject.GDI32(00000000), ref: 00A86DAD
                                                                                                                              • DeleteDC.GDI32(00000000), ref: 00A86DC5
                                                                                                                              • DeleteDC.GDI32(00000000), ref: 00A86DD7
                                                                                                                              • DeleteDC.GDI32(00000000), ref: 00A86DE9
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Delete$Object
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3217310620-0
                                                                                                                              • Opcode ID: e13c4f592fb17eac2f05edb7946496229012412133cedba8bc47ede88f3c2d18
                                                                                                                              • Instruction ID: e04f3799f5d9ef4d45ec952d7821b9674900effb7ee7e810de5ab01d7ede278d
                                                                                                                              • Opcode Fuzzy Hash: e13c4f592fb17eac2f05edb7946496229012412133cedba8bc47ede88f3c2d18
                                                                                                                              • Instruction Fuzzy Hash: B5017DB1B20624AB9B11EFEDECC485BB7EEE784710329490BE200D3224DF759C428F50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8625A Relevance: 9.0, APIs: 2, Strings: 4, Instructions: 32COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00A86272
                                                                                                                              • GetLastError.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000,?), ref: 00A8627D
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              Strings
                                                                                                                              • e:\bt\382730\setup\deliverables\dxsetup\psheets.cpp, xrefs: 00A86290
                                                                                                                              • CloseHandle(), xrefs: 00A86284
                                                                                                                              • CDXWSetup::~CDXWSetup, xrefs: 00A86289
                                                                                                                              • ~CDXWSetup(), xrefs: 00A8625D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$CloseErrorHandleLast_strrchr
                                                                                                                              • String ID: CDXWSetup::~CDXWSetup$CloseHandle()$e:\bt\382730\setup\deliverables\dxsetup\psheets.cpp$~CDXWSetup()
                                                                                                                              • API String ID: 4205222315-3347362006
                                                                                                                              • Opcode ID: aea01310b40e3e611dc4e2aff3a12846d6ccf67cdc21031f33ac84e1ea759f79
                                                                                                                              • Instruction ID: d40445c39e621807c0eb4c068494eb3d12fd83287849062aa667b673186b3da4
                                                                                                                              • Opcode Fuzzy Hash: aea01310b40e3e611dc4e2aff3a12846d6ccf67cdc21031f33ac84e1ea759f79
                                                                                                                              • Instruction Fuzzy Hash: 7FE06572E41B107BAA3477705C0AE6A266CAA40F203154E49B944A7182EF64DD4283D1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69759427 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 187COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 6975066E: __getptd.LIBCMT ref: 69750681
                                                                                                                              • __stricmp_l.LIBCMT ref: 697594B8
                                                                                                                              • ___crtLCMapStringA.LIBCMT ref: 69759511
                                                                                                                              • ___crtLCMapStringA.LIBCMT ref: 6975959A
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: String___crt$__getptd__stricmp_l
                                                                                                                              • String ID: V<ui$V<ui
                                                                                                                              • API String ID: 2420264727-905468543
                                                                                                                              • Opcode ID: 9bfd4013d8a1680e5bb27d3c5b408378f0e765a01aaa5cef8dde96e3a88c048b
                                                                                                                              • Instruction ID: 5f6f68da2843a4b04b4e51bc9c8ea9593131e4e193612584761a379cafef1f8f
                                                                                                                              • Opcode Fuzzy Hash: 9bfd4013d8a1680e5bb27d3c5b408378f0e765a01aaa5cef8dde96e3a88c048b
                                                                                                                              • Instruction Fuzzy Hash: 225148F0C041AADBDB92CB58C685BEE7BB4EB22365F544195E0A35B0D1DF308A75CB60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69755C5A Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___free_lconv_mon.LIBCMT ref: 69755CA0
                                                                                                                              • ___free_lconv_num.LIBCMT ref: 69755CC1
                                                                                                                                • Part of subcall function 6975037B: ___sbh_find_block.LIBCMT ref: 697503A4
                                                                                                                                • Part of subcall function 6975037B: HeapFree.KERNEL32(00000000,69747D8D,6975B418), ref: 697503E3
                                                                                                                                • Part of subcall function 6975037B: GetLastError.KERNEL32(?,6975186F,00000004,6975B500,0000000C,697581A1,69747D8D,00066BDB,00000000,00000000,00000000,?,6975143E,00000001,00000214), ref: 697503F4
                                                                                                                              • ___free_lc_time.LIBCMT ref: 69755D46
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFreeHeapLast___free_lc_time___free_lconv_mon___free_lconv_num___sbh_find_block
                                                                                                                              • String ID: (ui$hui
                                                                                                                              • API String ID: 1256667415-2239975987
                                                                                                                              • Opcode ID: 78d66647483a41a269b654e0bf66656bb81f4b2944ce01762e44e276db842bae
                                                                                                                              • Instruction ID: 2e5d446f410c2890cef6429115cd3da265bc1b656b648f1a8eb654c803362d27
                                                                                                                              • Opcode Fuzzy Hash: 78d66647483a41a269b654e0bf66656bb81f4b2944ce01762e44e276db842bae
                                                                                                                              • Instruction Fuzzy Hash: 4C314D761087029FEB919F74EBCCB5A77A6BB01318F50493EE11BE7121CF31A9608A51
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09D0BB Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 112COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___free_lconv_mon.LIBCMT ref: 6C09D101
                                                                                                                              • ___free_lconv_num.LIBCMT ref: 6C09D122
                                                                                                                                • Part of subcall function 6C096F02: ___sbh_find_block.LIBCMT ref: 6C096F2B
                                                                                                                                • Part of subcall function 6C096F02: HeapFree.KERNEL32(00000000,00000000,6C0A26A0), ref: 6C096F6A
                                                                                                                                • Part of subcall function 6C096F02: GetLastError.KERNEL32(?,6C098098,00000004,6C0A2788,0000000C,6C09DAD8,00000000,00000000,00000000,00000000,00000000,?,6C097C67,00000001,00000214), ref: 6C096F7B
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFreeHeapLast___free_lconv_mon___free_lconv_num___sbh_find_block
                                                                                                                              • String ID: Ml$Fl$Ml
                                                                                                                              • API String ID: 4074146912-2945573283
                                                                                                                              • Opcode ID: 01cb32f643470e5eae7e65cd162261919ec33ebe434072e387b562869cbcbfce
                                                                                                                              • Instruction ID: 2c87abbd9dbe2e6eb87e16af03e9ae8e5950f2aaa08a999b5c47aa22e1e8e22b
                                                                                                                              • Opcode Fuzzy Hash: 01cb32f643470e5eae7e65cd162261919ec33ebe434072e387b562869cbcbfce
                                                                                                                              • Instruction Fuzzy Hash: B6319473149301AFEB105FA8D881F9673F6EB00718F20692EE116C7A51CB31B884F665
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974AF5E Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 73COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$_strrchr
                                                                                                                              • String ID: GetSectionNamesFromInf() failed.$Invalid buffer.$IsSectionInInf$e:\bt\382730\setup\deliverables\dsetup\dsetup32\inline.h
                                                                                                                              • API String ID: 4138713405-2443459792
                                                                                                                              • Opcode ID: e5b644487d0af602778b3a5fa708f81d3648d1eebb99ba9939d4d38627a5b18b
                                                                                                                              • Instruction ID: f643a5b1cb991edbb0ec3154cb9c9258202f10e8c8429a268276bb1dee9fbfd4
                                                                                                                              • Opcode Fuzzy Hash: e5b644487d0af602778b3a5fa708f81d3648d1eebb99ba9939d4d38627a5b18b
                                                                                                                              • Instruction Fuzzy Hash: 291157F1808108FADB009A658F85D9EB7AC9B51F68FA00439F115B2093F772AF964261
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974DD1D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _strnlen.LIBCMT ref: 6974DD66
                                                                                                                              • _strnlen.LIBCMT ref: 6974DD7E
                                                                                                                              • _strrchr.LIBCMT ref: 6974DD22
                                                                                                                                • Part of subcall function 697466CC: CompareStringA.KERNEL32(00000409,00000001,69746892,000000FF,?,000000FF,?,69746723,00000001,inf,69746892,?,697467C5,69746892,69746892,?), ref: 697466E2
                                                                                                                              Strings
                                                                                                                              • Changing source media for file %s\%s to %s\%s, xrefs: 6974DDA0
                                                                                                                              • dxxpdbg, xrefs: 6974DD2D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _strnlen$CompareString_strrchr
                                                                                                                              • String ID: Changing source media for file %s\%s to %s\%s$dxxpdbg
                                                                                                                              • API String ID: 895441675-2375301040
                                                                                                                              • Opcode ID: 74df962d001f694f501c2cba27fbe97586a11327bafb39bd496d509251cbc2a2
                                                                                                                              • Instruction ID: dbd6414e329f24c142d8bb12824cf54344594e03760087ae750de90e5b8593d1
                                                                                                                              • Opcode Fuzzy Hash: 74df962d001f694f501c2cba27fbe97586a11327bafb39bd496d509251cbc2a2
                                                                                                                              • Instruction Fuzzy Hash: 0E112775548201AAE701DA209F48F2F2B74FF82B64F10486FE846DA143EF21E5008A24
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A851A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FreeLibrary.KERNEL32(?,?,00A862AB,00000000,00A86927,?,?,?,?,?,?,00000000,00000000,?), ref: 00A851B3
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000,?), ref: 00A851BD
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A8393B
                                                                                                                                • Part of subcall function 00A8390A: __wstrtime.LIBCMT ref: 00A83944
                                                                                                                                • Part of subcall function 00A8390A: _strrchr.LIBCMT ref: 00A8398A
                                                                                                                              Strings
                                                                                                                              • CDllLoader::FreeLibrary, xrefs: 00A851CF
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h, xrefs: 00A851D9
                                                                                                                              • FreeLibrary(), xrefs: 00A851CA
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$ErrorFreeLastLibrary_strrchr
                                                                                                                              • String ID: CDllLoader::FreeLibrary$FreeLibrary()$e:\bt\382730\setup\deliverables\dsetup\inc\dsinline.h
                                                                                                                              • API String ID: 2808663981-1330908120
                                                                                                                              • Opcode ID: 279b20e4c2665e2c5ee5f39fbce9b95f2ac162cff32923bc4acdbe97f5ee4a3d
                                                                                                                              • Instruction ID: b2b35ce54ba09df63b43387726202ab3ac1ac1ada918f179afbb7f5fce003397
                                                                                                                              • Opcode Fuzzy Hash: 279b20e4c2665e2c5ee5f39fbce9b95f2ac162cff32923bc4acdbe97f5ee4a3d
                                                                                                                              • Instruction Fuzzy Hash: FAE04F72B546116BE7607BB6AC1EF6235DCAB40B61F150969BC45D2081FA90C9438750
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69750AE1 Relevance: 7.6, APIs: 5, Instructions: 145COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _memset$__fileno__locking_memcpy_s
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2792269882-0
                                                                                                                              • Opcode ID: e5c4a98e0dd5c029622459a431dffb8e21ca16eeedef59267bf75a4a5bd1fa90
                                                                                                                              • Instruction ID: 4f30a2b6f43043fc2013792cf081f005c86346cda51966a7a33cdd7db263eac1
                                                                                                                              • Opcode Fuzzy Hash: e5c4a98e0dd5c029622459a431dffb8e21ca16eeedef59267bf75a4a5bd1fa90
                                                                                                                              • Instruction Fuzzy Hash: 1E41A575900609EFDB50CFA9CE846DEBBB5FF4136CF108569E82A93150EB309A61CF51
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69752217 Relevance: 7.5, APIs: 5, Instructions: 44timethreadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6975224B
                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 69752257
                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 6975225F
                                                                                                                              • GetTickCount.KERNEL32 ref: 69752267
                                                                                                                              • QueryPerformanceCounter.KERNEL32(?), ref: 69752273
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1445889803-0
                                                                                                                              • Opcode ID: 336ea9f9b930594a14ecaa094a76c14019141423c570609f64ab7497a5027f19
                                                                                                                              • Instruction ID: 81991627ba00062668c26aaf8b85e0da01802ba1b648ba8e538412b3aeb1a788
                                                                                                                              • Opcode Fuzzy Hash: 336ea9f9b930594a14ecaa094a76c14019141423c570609f64ab7497a5027f19
                                                                                                                              • Instruction Fuzzy Hash: 9301B176D00268DBCF90ABF8C5486AEB7F8FF09351F460572E811E7104DB309950CB80
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A89591 Relevance: 7.5, APIs: 5, Instructions: 44timethreadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00A895C5
                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 00A895D1
                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 00A895D9
                                                                                                                              • GetTickCount.KERNEL32 ref: 00A895E1
                                                                                                                              • QueryPerformanceCounter.KERNEL32(?), ref: 00A895ED
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1445889803-0
                                                                                                                              • Opcode ID: b05902aa8cc4c7bd6a1a17aabd0eeb2843bcfca73fa63b7cb52ab5794327e5cc
                                                                                                                              • Instruction ID: e483888e34b522f3aba6007bafc738c9c3e6ce9d9dbdac596cfa12cfa873588a
                                                                                                                              • Opcode Fuzzy Hash: b05902aa8cc4c7bd6a1a17aabd0eeb2843bcfca73fa63b7cb52ab5794327e5cc
                                                                                                                              • Instruction Fuzzy Hash: 05017176D001249BCB20EBF8E94C6EEB7F8FF48351F960965DA11E7110EB34994ACB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C098A40 Relevance: 7.5, APIs: 5, Instructions: 44timethreadCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6C098A74
                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 6C098A80
                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 6C098A88
                                                                                                                              • GetTickCount.KERNEL32 ref: 6C098A90
                                                                                                                              • QueryPerformanceCounter.KERNEL32(?), ref: 6C098A9C
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1445889803-0
                                                                                                                              • Opcode ID: 3defcd2fbbd03b61b413c218c16d9ba800bb69af409735936661d421952f469c
                                                                                                                              • Instruction ID: cb36aa29e321779abf3937c9c9de7290345ca551d7b58042da6cf8ea02b28441
                                                                                                                              • Opcode Fuzzy Hash: 3defcd2fbbd03b61b413c218c16d9ba800bb69af409735936661d421952f469c
                                                                                                                              • Instruction Fuzzy Hash: AA015276E00614ABCF109FF9E50879EB7F8FB49351F561652D411E7204DF709A40AB80
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A852DE Relevance: 7.5, APIs: 5, Instructions: 34windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MessageSend$ItemShowWindow
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1207805008-0
                                                                                                                              • Opcode ID: 9afd8280044f67211c5e8e02846c2d864a11e4c0fad259d925f022170bff832c
                                                                                                                              • Instruction ID: 79bd36dfea7c4d26c17fb570e9f35267fd3e41bfda08990bb4193bf215e7705d
                                                                                                                              • Opcode Fuzzy Hash: 9afd8280044f67211c5e8e02846c2d864a11e4c0fad259d925f022170bff832c
                                                                                                                              • Instruction Fuzzy Hash: 9BF0397528022476E62056569C4AF6B3E2DD7C2FA1F10401AFB04B90D0CAF5680396A9
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A917F2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 70COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __itow
                                                                                                                              • String ID: $#$.
                                                                                                                              • API String ID: 3482036329-1065809056
                                                                                                                              • Opcode ID: 452e9b751ce1629aa891f4ba2ebd22af448115b93f5a9808ed0acdfc9bd0cda9
                                                                                                                              • Instruction ID: 2e619ae5d1d79afbbf716200e33dd932ac751fafe9eb32f0f58904b4e70e378b
                                                                                                                              • Opcode Fuzzy Hash: 452e9b751ce1629aa891f4ba2ebd22af448115b93f5a9808ed0acdfc9bd0cda9
                                                                                                                              • Instruction Fuzzy Hash: 6621F23160428AABDF11CF6CDA05BEE7FE49F09304F284499EC80E7281EB759A15D7A5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09497C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              • distinction98 failed generally, xrefs: 6C0949AB
                                                                                                                              • distinction98 failed GetKeyboardType, xrefs: 6C09498E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: KeyboardType
                                                                                                                              • String ID: distinction98 failed GetKeyboardType$distinction98 failed generally
                                                                                                                              • API String ID: 1620330385-80016554
                                                                                                                              • Opcode ID: 28e993830d78e427169079178337c6132801e6613bfbd0e3e015005f2e7a2088
                                                                                                                              • Instruction ID: 53d7a115f4e67baa16ee602229083bd9220f37a8889b44a23b14f9f297fb286b
                                                                                                                              • Opcode Fuzzy Hash: 28e993830d78e427169079178337c6132801e6613bfbd0e3e015005f2e7a2088
                                                                                                                              • Instruction Fuzzy Hash: C8E0176376C1203AEB8862FD7C14BAD15D9878A239F156966A12AD7980E840988222D5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A87A2D Relevance: 6.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: String___crt$__freea_strnlen
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2812305112-0
                                                                                                                              • Opcode ID: 2326b0aad0bef6889c5fde1229ca296a14c8a314d2289c1f7de351625fffc666
                                                                                                                              • Instruction ID: b16667b83b8e0361049a29cf2d7e0e1abd064a004fa92b98385dfefe5763cb94
                                                                                                                              • Opcode Fuzzy Hash: 2326b0aad0bef6889c5fde1229ca296a14c8a314d2289c1f7de351625fffc666
                                                                                                                              • Instruction Fuzzy Hash: D0412771A08105AFEF18BF64CC85DAEBBB6DF45360F34406AF1169B251EA31CD81C761
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A919DF Relevance: 6.1, APIs: 4, Instructions: 135COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __locking$__fileno__lseeki64
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3501863086-0
                                                                                                                              • Opcode ID: a54f676bbefbce356167085ee0bd0bc1e1cfa12ce7eae5dc2c990e1cbc7d71bf
                                                                                                                              • Instruction ID: f999a239f47e8f88b0b3e09872c819ad48d0c223d0de9c10d2ca0a9ac483b25b
                                                                                                                              • Opcode Fuzzy Hash: a54f676bbefbce356167085ee0bd0bc1e1cfa12ce7eae5dc2c990e1cbc7d71bf
                                                                                                                              • Instruction Fuzzy Hash: D041F371A00B029EDF349F29C945A667BE4EF413B4B14CA2DE8BACB690E634DD418B50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697584D1 Relevance: 6.1, APIs: 4, Instructions: 134COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _memset.LIBCMT ref: 69758552
                                                                                                                              • WideCharToMultiByte.KERNEL32(680779C0,00000000,?,00000001,?,697462C9,00000000,?,?,?,?,?,697462C9,?,?,00000000), ref: 697585E5
                                                                                                                              • GetLastError.KERNEL32 ref: 69758603
                                                                                                                              • _memset.LIBCMT ref: 69758625
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _memset$ByteCharErrorLastMultiWide
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 773584764-0
                                                                                                                              • Opcode ID: b7c3608682d281c14bd26d773865ed3e9088976e12a74003e2943e924ec2c368
                                                                                                                              • Instruction ID: 0bf5f88e6376cfb979e0c0d8f1e575680dc6976663f61ba45bdb0b310774010b
                                                                                                                              • Opcode Fuzzy Hash: b7c3608682d281c14bd26d773865ed3e9088976e12a74003e2943e924ec2c368
                                                                                                                              • Instruction Fuzzy Hash: 6741F6B2A10146EFDB90DF58CAD48DE7B74FB02354B01427AE4238B290DF319EA18B61
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8F735 Relevance: 6.1, APIs: 4, Instructions: 134COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _memset.LIBCMT ref: 00A8F7B6
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00A8F849
                                                                                                                              • GetLastError.KERNEL32(?,?,00000000), ref: 00A8F867
                                                                                                                              • _memset.LIBCMT ref: 00A8F889
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _memset$ByteCharErrorLastMultiWide
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 773584764-0
                                                                                                                              • Opcode ID: 20f688219c08909614674794cdf8f4f3b178754c2e72f3bee5bbf0246dec29d7
                                                                                                                              • Instruction ID: 212f9af608ff4a311fc87d490ebc5c910fd5ebaf61ed4852433bf31624383fbe
                                                                                                                              • Opcode Fuzzy Hash: 20f688219c08909614674794cdf8f4f3b178754c2e72f3bee5bbf0246dec29d7
                                                                                                                              • Instruction Fuzzy Hash: D4410272900147AFEF30BFA8D8C59AE7B74EB01320F14427AF5259B291D7319D81CBA2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09E637 Relevance: 6.1, APIs: 4, Instructions: 134COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _memset.LIBCMT ref: 6C09E6B8
                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C09E74B
                                                                                                                              • GetLastError.KERNEL32 ref: 6C09E769
                                                                                                                              • _memset.LIBCMT ref: 6C09E78B
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _memset$ByteCharErrorLastMultiWide
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 773584764-0
                                                                                                                              • Opcode ID: 5d1ff6b1f53aad791cfea6d256f31bfd778af79eb7a92be4daf211f16cb6a96e
                                                                                                                              • Instruction ID: c0868a64374eb7e809b57885fc9a6f4ea0c9eab0cc7df5037d54f8137d7dddf6
                                                                                                                              • Opcode Fuzzy Hash: 5d1ff6b1f53aad791cfea6d256f31bfd778af79eb7a92be4daf211f16cb6a96e
                                                                                                                              • Instruction Fuzzy Hash: 03411571A00145EFDB109F58C890B9E7BFCBB42398B512169F1744BA90DB30AD45EBE2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0A1362 Relevance: 6.1, APIs: 4, Instructions: 130COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __locking$__fileno__lseeki64
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3501863086-0
                                                                                                                              • Opcode ID: a1aceeaa7eba7e33c404397c3e0a19234fc85f9191162e82a25cd5c0e1589480
                                                                                                                              • Instruction ID: bc8a6738518b36611047572a64ce52873d1805e8ef3ea1e3110b877e7ef8a563
                                                                                                                              • Opcode Fuzzy Hash: a1aceeaa7eba7e33c404397c3e0a19234fc85f9191162e82a25cd5c0e1589480
                                                                                                                              • Instruction Fuzzy Hash: 0F41B372505B01DFD7248FDDC841B9A77E4EF41328B20D62DE8BA9BE92D734E9068B50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697589C4 Relevance: 6.1, APIs: 4, Instructions: 125COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __mtinitlocknum.LIBCMT ref: 697589DB
                                                                                                                                • Part of subcall function 6975495C: __FF_MSGBANNER.LIBCMT ref: 69754978
                                                                                                                              • ___crtInitCritSecAndSpinCount.LIBCMT ref: 69758A53
                                                                                                                              • EnterCriticalSection.KERNEL32(00000115,6975B7A0,00000018,69758EF2,00000109,00000000,00000000), ref: 69758A7A
                                                                                                                              • LeaveCriticalSection.KERNEL32(00000115), ref: 69758A87
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CriticalSection$CountCritEnterInitLeaveSpin___crt__mtinitlocknum
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2663194512-0
                                                                                                                              • Opcode ID: 4a1702ff30a117cb87dd3e49f16457a10cf1f18ac9e9f0d3d525dcf76b1b1040
                                                                                                                              • Instruction ID: 818ad68e1e2331f8ae7cd7084c686f6184c097b99c1b02042b39997c950b0916
                                                                                                                              • Opcode Fuzzy Hash: 4a1702ff30a117cb87dd3e49f16457a10cf1f18ac9e9f0d3d525dcf76b1b1040
                                                                                                                              • Instruction Fuzzy Hash: E341E271E583428BDB94DF69CA4A79DBBF4AF02328F148229D1239B1D0DF709591CB14
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8FC34 Relevance: 6.1, APIs: 4, Instructions: 125COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __mtinitlocknum.LIBCMT ref: 00A8FC4B
                                                                                                                                • Part of subcall function 00A8DA99: __FF_MSGBANNER.LIBCMT ref: 00A8DAB5
                                                                                                                              • ___crtInitCritSecAndSpinCount.LIBCMT ref: 00A8FCC3
                                                                                                                              • EnterCriticalSection.KERNEL32(00000115,00A96428,00000018,00A90162,00000109,00000000,00000000), ref: 00A8FCEA
                                                                                                                              • LeaveCriticalSection.KERNEL32(00000115), ref: 00A8FCF7
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CriticalSection$CountCritEnterInitLeaveSpin___crt__mtinitlocknum
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2663194512-0
                                                                                                                              • Opcode ID: b5b79902ca57678bdbf50b3c82719a44e8c222c5171ad6eaab873836bad60b44
                                                                                                                              • Instruction ID: 4d56711f8d7d316daba46f32e488521f4584777385437ae11f496326257f3bec
                                                                                                                              • Opcode Fuzzy Hash: b5b79902ca57678bdbf50b3c82719a44e8c222c5171ad6eaab873836bad60b44
                                                                                                                              • Instruction Fuzzy Hash: 45412971E047078EDB24FFA8D94975DBBE0AF15728F24822DD6619A1D1CB749A418B10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09F473 Relevance: 6.1, APIs: 4, Instructions: 125COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __mtinitlocknum.LIBCMT ref: 6C09F48A
                                                                                                                                • Part of subcall function 6C09AD11: __FF_MSGBANNER.LIBCMT ref: 6C09AD2D
                                                                                                                              • ___crtInitCritSecAndSpinCount.LIBCMT ref: 6C09F502
                                                                                                                              • EnterCriticalSection.KERNEL32(00000115,6C0A29D0,00000018,6C09F9A1,00000109,00000000,00000000), ref: 6C09F529
                                                                                                                              • LeaveCriticalSection.KERNEL32(00000115), ref: 6C09F536
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CriticalSection$CountCritEnterInitLeaveSpin___crt__mtinitlocknum
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2663194512-0
                                                                                                                              • Opcode ID: d8174ed7af60b89a8def7cae9d809951d04cf3ddeba6182770d70b748f3ee7bb
                                                                                                                              • Instruction ID: f51bd93b0b3ebae19ee188e643049050e4f9ca7b63db57308a2d512202198eb8
                                                                                                                              • Opcode Fuzzy Hash: d8174ed7af60b89a8def7cae9d809951d04cf3ddeba6182770d70b748f3ee7bb
                                                                                                                              • Instruction Fuzzy Hash: AB412B71A087068BDB14CFA9D84878D7BF86F0232CF28A35DF26197AD1CB74D545AB10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697557BC Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __getptd.LIBCMT ref: 697557C8
                                                                                                                                • Part of subcall function 69751488: __amsg_exit.LIBCMT ref: 69751498
                                                                                                                              • __amsg_exit.LIBCMT ref: 697557E8
                                                                                                                              • InterlockedDecrement.KERNEL32(?), ref: 69755815
                                                                                                                              • InterlockedIncrement.KERNEL32(02391408), ref: 69755840
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2662827482-0
                                                                                                                              • Opcode ID: 8c4d5f7da2d8c38e3d2b79c93d5b3a73144923d811f90278ba0295afdd357bb9
                                                                                                                              • Instruction ID: b2c91ed8693b8c0957d1977450e4f4497714bc7413d7a120080794601fb29f35
                                                                                                                              • Opcode Fuzzy Hash: 8c4d5f7da2d8c38e3d2b79c93d5b3a73144923d811f90278ba0295afdd357bb9
                                                                                                                              • Instruction Fuzzy Hash: FB018039900B11EBDBC0EB65974976D77A0BF46724F11812AD812E7290CF34A971CBDE
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A8BCC5 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __getptd.LIBCMT ref: 00A8BCD1
                                                                                                                                • Part of subcall function 00A88F41: __amsg_exit.LIBCMT ref: 00A88F51
                                                                                                                              • __amsg_exit.LIBCMT ref: 00A8BCF1
                                                                                                                              • InterlockedDecrement.KERNEL32(?), ref: 00A8BD1E
                                                                                                                              • InterlockedIncrement.KERNEL32(002B1408), ref: 00A8BD49
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2662827482-0
                                                                                                                              • Opcode ID: 61aa66a4c477dd88874d654623baff22804ce58a2259a4091d32cd14ac4a2e2e
                                                                                                                              • Instruction ID: 5d068281406442121ab8225ca8fe680d4ba1f795a2f963eb425258935de39202
                                                                                                                              • Opcode Fuzzy Hash: 61aa66a4c477dd88874d654623baff22804ce58a2259a4091d32cd14ac4a2e2e
                                                                                                                              • Instruction Fuzzy Hash: 9B01B971E12B21ABDB24FFA59949B6D77A0BF05710F110146F81067391CF78AD42CBE6
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09D624 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • __getptd.LIBCMT ref: 6C09D630
                                                                                                                                • Part of subcall function 6C097CB1: __amsg_exit.LIBCMT ref: 6C097CC1
                                                                                                                              • __amsg_exit.LIBCMT ref: 6C09D650
                                                                                                                              • InterlockedDecrement.KERNEL32(?), ref: 6C09D67D
                                                                                                                              • InterlockedIncrement.KERNEL32(00931408), ref: 6C09D6A8
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2662827482-0
                                                                                                                              • Opcode ID: bc9f0dcfbeeaa38749c48ae0fe74f2ce1c58fbc653e636151e31c9410ab2550e
                                                                                                                              • Instruction ID: 4861426049a1a07f438ad666d729ffab89afcc3dbfb583fb6d736c72e56662e3
                                                                                                                              • Opcode Fuzzy Hash: bc9f0dcfbeeaa38749c48ae0fe74f2ce1c58fbc653e636151e31c9410ab2550e
                                                                                                                              • Instruction Fuzzy Hash: 6C018B36E41B11ABDB119FE9A00478D77F8AB01798F122105E828A7E81CF34A945FBD5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69751407 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(00066BDB,69747D8D,697533DE,69754192,?,?,6974FCAF,69747D8D,?,?,6974770E,00066BDC,?,?,00000000), ref: 6975140B
                                                                                                                              • ___set_flsgetvalue.LIBCMT ref: 69751413
                                                                                                                                • Part of subcall function 697512DD: TlsGetValue.KERNEL32 ref: 697512E3
                                                                                                                                • Part of subcall function 697512DD: TlsSetValue.KERNEL32(00000000,?,6974FCAF,69747D8D,?,?,6974770E,00066BDC,?,?,00000000,?,?,697477A6,SETUP_AGREEMENT_ENG,000012F1), ref: 69751300
                                                                                                                              • TlsGetValue.KERNEL32 ref: 69751424
                                                                                                                              • SetLastError.KERNEL32(00000000,?,?,6974FCAF,69747D8D,?,?,6974770E,00066BDC,?,?,00000000,?,?,697477A6,SETUP_AGREEMENT_ENG), ref: 69751478
                                                                                                                                • Part of subcall function 6975818B: __calloc_impl.LIBCMT ref: 6975819C
                                                                                                                                • Part of subcall function 6975818B: Sleep.KERNEL32(00000000,00066BDB,69747D8D), ref: 697581B3
                                                                                                                                • Part of subcall function 69751264: TlsGetValue.KERNEL32 ref: 69751276
                                                                                                                                • Part of subcall function 69751264: TlsGetValue.KERNEL32 ref: 6975128D
                                                                                                                                • Part of subcall function 69751264: RtlDecodePointer.NTDLL(69747D8D,?,697541C6,?,6975418C,69747D8D,?,?,6974FCAF,69747D8D,?,?,6974770E,00066BDC), ref: 697512BF
                                                                                                                                • Part of subcall function 6975134E: GetModuleHandleA.KERNEL32(KERNEL32.DLL,6975B4B8,0000000C,69751467,00000000,00000000,?,?,6974FCAF,69747D8D,?,?,6974770E,00066BDC), ref: 6975135F
                                                                                                                                • Part of subcall function 6975134E: GetProcAddress.KERNEL32(00000000,EncodePointer,?,?,6974FCAF,69747D8D), ref: 69751388
                                                                                                                                • Part of subcall function 6975134E: GetProcAddress.KERNEL32(?,DecodePointer,?,?,6974FCAF,69747D8D), ref: 69751398
                                                                                                                                • Part of subcall function 6975134E: InterlockedIncrement.KERNEL32(6975D950), ref: 697513BA
                                                                                                                                • Part of subcall function 6975134E: ___addlocaleref.LIBCMT ref: 697513E1
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$AddressErrorLastProc$DecodeHandleIncrementInterlockedModulePointerSleep___addlocaleref___set_flsgetvalue__calloc_impl
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1156233384-0
                                                                                                                              • Opcode ID: 5ce3054a3c6af2717ded568490f5b7e598f750dd2d7a9c67eb07f9f2435f7166
                                                                                                                              • Instruction ID: 2793fea14e9dee419cbf3a5e9e073fbba5509678f8f250af44edaae2de70971b
                                                                                                                              • Opcode Fuzzy Hash: 5ce3054a3c6af2717ded568490f5b7e598f750dd2d7a9c67eb07f9f2435f7166
                                                                                                                              • Instruction Fuzzy Hash: 68F02836604661A7EBE13BB49E0DAAA3A509F43B76B109136E512E50E0DF10CC238780
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A88EC0 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(?,?,00A88F49,?,00A879B9,?,?,00A8988D,?,?,?,00000000), ref: 00A88EC4
                                                                                                                              • ___set_flsgetvalue.LIBCMT ref: 00A88ECC
                                                                                                                                • Part of subcall function 00A88D96: TlsGetValue.KERNEL32 ref: 00A88D9C
                                                                                                                                • Part of subcall function 00A88D96: TlsSetValue.KERNEL32(00000000,00A8988D,?,?,?,00000000), ref: 00A88DB9
                                                                                                                              • TlsGetValue.KERNEL32 ref: 00A88EDD
                                                                                                                              • SetLastError.KERNEL32(00000000,?,00A8988D,?,?,?,00000000), ref: 00A88F31
                                                                                                                                • Part of subcall function 00A8E453: __calloc_impl.LIBCMT ref: 00A8E464
                                                                                                                                • Part of subcall function 00A8E453: Sleep.KERNEL32(00000000,?,?,00000000), ref: 00A8E47B
                                                                                                                                • Part of subcall function 00A88D1D: TlsGetValue.KERNEL32 ref: 00A88D2F
                                                                                                                                • Part of subcall function 00A88D1D: TlsGetValue.KERNEL32 ref: 00A88D46
                                                                                                                                • Part of subcall function 00A88D1D: RtlDecodePointer.NTDLL(?,?,00A88DB1,?,00A8988D,?,?,?,00000000), ref: 00A88D78
                                                                                                                                • Part of subcall function 00A88E07: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00A96140,0000000C,00A88F20,00000000,00000000,?,00A8988D,?,?,?,00000000), ref: 00A88E18
                                                                                                                                • Part of subcall function 00A88E07: GetProcAddress.KERNEL32(00000000,EncodePointer,?,00A8988D,?,?,?,00000000), ref: 00A88E41
                                                                                                                                • Part of subcall function 00A88E07: GetProcAddress.KERNEL32(?,DecodePointer,?,00A8988D,?,?,?,00000000), ref: 00A88E51
                                                                                                                                • Part of subcall function 00A88E07: InterlockedIncrement.KERNEL32(00A985D0), ref: 00A88E73
                                                                                                                                • Part of subcall function 00A88E07: ___addlocaleref.LIBCMT ref: 00A88E9A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$AddressErrorLastProc$DecodeHandleIncrementInterlockedModulePointerSleep___addlocaleref___set_flsgetvalue__calloc_impl
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1156233384-0
                                                                                                                              • Opcode ID: 9d380db7b6420adfa97584cc9fb1d2f5a9d2afcaa266179165a7b5cb6ddc3c58
                                                                                                                              • Instruction ID: 0d867f9635b51efdf89431f15469eed50146c0dc1a8d190b2f34a49a461c20f7
                                                                                                                              • Opcode Fuzzy Hash: 9d380db7b6420adfa97584cc9fb1d2f5a9d2afcaa266179165a7b5cb6ddc3c58
                                                                                                                              • Instruction Fuzzy Hash: 6BF028326046216AC32173F4BC09B5A3A55DF457B1F20021AF614D21F0CF19CC0387D0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C097C30 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(00000000,?,6C099C8A,6C097462,e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c,00000000,?,GetRegistryDXVersion,e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c,00000000), ref: 6C097C34
                                                                                                                              • ___set_flsgetvalue.LIBCMT ref: 6C097C3C
                                                                                                                                • Part of subcall function 6C097B06: TlsGetValue.KERNEL32 ref: 6C097B0C
                                                                                                                                • Part of subcall function 6C097B06: TlsSetValue.KERNEL32(00000000), ref: 6C097B29
                                                                                                                              • TlsGetValue.KERNEL32 ref: 6C097C4D
                                                                                                                              • SetLastError.KERNEL32(00000000), ref: 6C097CA1
                                                                                                                                • Part of subcall function 6C09DAC2: __calloc_impl.LIBCMT ref: 6C09DAD3
                                                                                                                                • Part of subcall function 6C09DAC2: Sleep.KERNEL32(00000000,?,00000000,00000000,?,6C097C67,00000001,00000214), ref: 6C09DAEA
                                                                                                                                • Part of subcall function 6C097A8D: TlsGetValue.KERNEL32 ref: 6C097A9F
                                                                                                                                • Part of subcall function 6C097A8D: TlsGetValue.KERNEL32 ref: 6C097AB6
                                                                                                                                • Part of subcall function 6C097A8D: RtlDecodePointer.NTDLL(?,?,6C097B21), ref: 6C097AE8
                                                                                                                                • Part of subcall function 6C097B77: GetModuleHandleA.KERNEL32(KERNEL32.DLL,6C0A2740,0000000C,6C097C90,00000000,00000000), ref: 6C097B88
                                                                                                                                • Part of subcall function 6C097B77: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6C097BB1
                                                                                                                                • Part of subcall function 6C097B77: GetProcAddress.KERNEL32(?,DecodePointer), ref: 6C097BC1
                                                                                                                                • Part of subcall function 6C097B77: InterlockedIncrement.KERNEL32(6C0A47D8), ref: 6C097BE3
                                                                                                                                • Part of subcall function 6C097B77: ___addlocaleref.LIBCMT ref: 6C097C0A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$AddressErrorLastProc$DecodeHandleIncrementInterlockedModulePointerSleep___addlocaleref___set_flsgetvalue__calloc_impl
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1156233384-0
                                                                                                                              • Opcode ID: 8b3634e9ea85bda1ea9c2b0e9453047f1c661b5baebff79fa6f13ea135cc8262
                                                                                                                              • Instruction ID: 2d69e0bef609bc7da15d9aa0e83400f3bf7cd2027ad93fca421aef6fb5c95a6f
                                                                                                                              • Opcode Fuzzy Hash: 8b3634e9ea85bda1ea9c2b0e9453047f1c661b5baebff79fa6f13ea135cc8262
                                                                                                                              • Instruction Fuzzy Hash: 33F0A433701A21AACB2617B9AC08F9E7AE4AF82BB5B166129E514D2690DF21D8417690
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69749D2D Relevance: 6.0, APIs: 4, Instructions: 36windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetMessageA.USER32 ref: 69749D48
                                                                                                                              • TranslateMessage.USER32(?), ref: 69749D56
                                                                                                                              • DispatchMessageA.USER32 ref: 69749D60
                                                                                                                              • PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 69749D6E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$DispatchPeekTranslate
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4217535847-0
                                                                                                                              • Opcode ID: 67cbccf873fd9bda9ba368c8ad8bcbbc5e597f40bed9125bb24ad9b2cf70dbb4
                                                                                                                              • Instruction ID: c26f1fc6130787f5ffa66738c79c8e8668b38b0e528c9a6771fad9af2cc012e0
                                                                                                                              • Opcode Fuzzy Hash: 67cbccf873fd9bda9ba368c8ad8bcbbc5e597f40bed9125bb24ad9b2cf70dbb4
                                                                                                                              • Instruction Fuzzy Hash: FAF01C76E4212A778F20BAE68D0CCDBBFACEDA7AA47414132B515D2006E624D516CAB0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C093D1D Relevance: 6.0, APIs: 4, Instructions: 36windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetMessageA.USER32 ref: 6C093D38
                                                                                                                              • TranslateMessage.USER32(?), ref: 6C093D46
                                                                                                                              • DispatchMessageA.USER32 ref: 6C093D50
                                                                                                                              • PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 6C093D5E
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$DispatchPeekTranslate
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4217535847-0
                                                                                                                              • Opcode ID: 5405aead56587f08d7770544027b1cd32759f6c46ff4913a5e1d16767a50a83d
                                                                                                                              • Instruction ID: b7167788d5ba99349bcc7ff1c0f6917d13e084d84c417d167340051bada27b59
                                                                                                                              • Opcode Fuzzy Hash: 5405aead56587f08d7770544027b1cd32759f6c46ff4913a5e1d16767a50a83d
                                                                                                                              • Instruction Fuzzy Hash: BEF01C76A4612A778F10AAE69C4CEDF7FFCED8BAA47005121B519D3018EA24D106CAF0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6974E32A Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 29COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32 ref: 6974E32A
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463C2
                                                                                                                                • Part of subcall function 69746391: __wstrtime.LIBCMT ref: 697463CB
                                                                                                                                • Part of subcall function 69746391: _strrchr.LIBCMT ref: 69746411
                                                                                                                              Strings
                                                                                                                              • e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp, xrefs: 6974E360
                                                                                                                              • CabCallback, xrefs: 6974E356
                                                                                                                              • SPFILENOTIFY_DELETEERROR: %s, error = %d., xrefs: 6974E34D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __wstrtime$ErrorLast_strrchr
                                                                                                                              • String ID: CabCallback$SPFILENOTIFY_DELETEERROR: %s, error = %d.$e:\bt\382730\setup\deliverables\dsetup\dsetup32\setup.cpp
                                                                                                                              • API String ID: 205445871-2425475416
                                                                                                                              • Opcode ID: 5b0b81224d161a0d27bfdb51c60a2ab93e97baafd6021a28d440303efd4063c5
                                                                                                                              • Instruction ID: 27204b9fe62ab8b6299197194e60efd4d82313c5cbb3c35e1e904bbab3cc2d04
                                                                                                                              • Opcode Fuzzy Hash: 5b0b81224d161a0d27bfdb51c60a2ab93e97baafd6021a28d440303efd4063c5
                                                                                                                              • Instruction Fuzzy Hash: AEE0C63A384108FEEB20E6408F83FFD3308EB02F00F20086BE583E90C3CAE0AA009510
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C09C2AE Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 22COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • LeaveCriticalSection.KERNEL32(-00000020,`"l,6C097572,00000000,6C097561,6C0A51A8,6C092260,00000000,e:\bt\382730\setup\deliverables\dsetup\dsetup\dsetup.c), ref: 6C09C2DB
                                                                                                                                • Part of subcall function 6C09ACF5: LeaveCriticalSection.KERNEL32(?,6C09B6EE,00000004,6C09B6DE,6C0A2808,0000000C,6C09B753,00000000,00000001,00000000,00000000,?,6C09AD5E,00000018,6C0A27E8,0000000C), ref: 6C09AD04
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CriticalLeaveSection
                                                                                                                              • String ID: ^l$`"l$El
                                                                                                                              • API String ID: 3988221542-2624185380
                                                                                                                              • Opcode ID: 07b242e7d3347fc356e82c73e89778d11fe04ceff99c60176e337dd5cd17860d
                                                                                                                              • Instruction ID: b3f4500c134776eb51cf58fa93555e2df932240821abe229e4b59476ad2c71b4
                                                                                                                              • Opcode Fuzzy Hash: 07b242e7d3347fc356e82c73e89778d11fe04ceff99c60176e337dd5cd17860d
                                                                                                                              • Instruction Fuzzy Hash: 7DD02B7BA00204679B1418F5684770933DDD1848503152815F909C6B86DE11F0410006
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C097CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • InterlockedDecrement.KERNEL32(?), ref: 6C097D8A
                                                                                                                              • ___removelocaleref.LIBCMT ref: 6C097DC6
                                                                                                                                • Part of subcall function 6C096F02: ___sbh_find_block.LIBCMT ref: 6C096F2B
                                                                                                                                • Part of subcall function 6C096F02: HeapFree.KERNEL32(00000000,00000000,6C0A26A0), ref: 6C096F6A
                                                                                                                                • Part of subcall function 6C096F02: GetLastError.KERNEL32(?,6C098098,00000004,6C0A2788,0000000C,6C09DAD8,00000000,00000000,00000000,00000000,00000000,?,6C097C67,00000001,00000214), ref: 6C096F7B
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DecrementErrorFreeHeapInterlockedLast___removelocaleref___sbh_find_block
                                                                                                                              • String ID: @l
                                                                                                                              • API String ID: 1099687001-1325873179
                                                                                                                              • Opcode ID: 20cd42f9daa1fe69e5e5f06069da286ebbfa8f7ba2df1d139c3703497ad322da
                                                                                                                              • Instruction ID: 5d317d2abf4632be98e3568d268199f380b00bd4edcf745f44226627a9e29b74
                                                                                                                              • Opcode Fuzzy Hash: 20cd42f9daa1fe69e5e5f06069da286ebbfa8f7ba2df1d139c3703497ad322da
                                                                                                                              • Instruction Fuzzy Hash: 0F31ADB360A7105ADE149ABDA845FAA33F86F00718B30790DE016DBEA1DF34F584B568
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6975796E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 6975066E: __getptd.LIBCMT ref: 69750681
                                                                                                                              • __isleadbyte_l.LIBCMT ref: 69757A03
                                                                                                                              • ___crtLCMapStringA.LIBCMT ref: 69757A50
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: String___crt__getptd__isleadbyte_l
                                                                                                                              • String ID: V<ui
                                                                                                                              • API String ID: 4030240610-2222311385
                                                                                                                              • Opcode ID: 7ae7c3d9a27ed50ae935aed60504f148e3926959a4f646f464362ce4ce06f274
                                                                                                                              • Instruction ID: 68d2417ab4030e36b9d3cb5b8e26cd28257632c0eb475ce733f63d5bba90553d
                                                                                                                              • Opcode Fuzzy Hash: 7ae7c3d9a27ed50ae935aed60504f148e3926959a4f646f464362ce4ce06f274
                                                                                                                              • Instruction Fuzzy Hash: 9531C331D08289AFDF41CBA8CA46FEE7FB4AF01304F1480A9E5569B192DF31C651CBA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A93262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __fltout2
                                                                                                                              • String ID: -
                                                                                                                              • API String ID: 3994888974-2547889144
                                                                                                                              • Opcode ID: e7bbffc55938458cf24adc8f0e9dd9f7323a4dafa5e8e11502b017f858123cd3
                                                                                                                              • Instruction ID: a7f11a790c88b5f57cc84d178f842192aa4b463b04d5bfc68bda851b97b841b9
                                                                                                                              • Opcode Fuzzy Hash: e7bbffc55938458cf24adc8f0e9dd9f7323a4dafa5e8e11502b017f858123cd3
                                                                                                                              • Instruction Fuzzy Hash: 8821C177B00119ABCF18AF78CC818EF7BB9EF18320B148129F522E7180EA31DA148761
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69751EDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___initmbctable.LIBCMT ref: 69751EF0
                                                                                                                                • Part of subcall function 69755C37: __setmbcp.LIBCMT ref: 69755C42
                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe,00000104,?,?,?,6974F326), ref: 69751F07
                                                                                                                              Strings
                                                                                                                              • C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe, xrefs: 69751EFA, 69751EFF
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileModuleName___initmbctable__setmbcp
                                                                                                                              • String ID: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                              • API String ID: 2741541922-2796865217
                                                                                                                              • Opcode ID: b4b429925b0fb1af816c19cd2bb150232051ff19cf3dc2552e59ce6f8f80dd1b
                                                                                                                              • Instruction ID: fca21a1b519ae693124b864a474489179fd8ee5126e02394d3f18f857f5c1352
                                                                                                                              • Opcode Fuzzy Hash: b4b429925b0fb1af816c19cd2bb150232051ff19cf3dc2552e59ce6f8f80dd1b
                                                                                                                              • Instruction Fuzzy Hash: E9212B71D0518CFFDF90CF659E8089E7BB8EE41365B1006B9E522E3181DB30AE61CB51
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00A88869 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___initmbctable.LIBCMT ref: 00A8887E
                                                                                                                                • Part of subcall function 00A8C140: __setmbcp.LIBCMT ref: 00A8C14B
                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe,00000104), ref: 00A88895
                                                                                                                              Strings
                                                                                                                              • C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe, xrefs: 00A88888, 00A8888D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580083230.0000000000A81000.00000020.00000001.01000000.00000015.sdmp, Offset: 00A80000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580073515.0000000000A80000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580093263.0000000000A98000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580103105.0000000000A9C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_a80000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileModuleName___initmbctable__setmbcp
                                                                                                                              • String ID: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                              • API String ID: 2741541922-2796865217
                                                                                                                              • Opcode ID: a7c9fade0712923ee3ec9ab65136ea134ce3ea05e8ad23584895c2e21141bf4a
                                                                                                                              • Instruction ID: c51e4544273f3fc7f012f3c64286128a38a5daee23f3a2b1fbb919f9408daa02
                                                                                                                              • Opcode Fuzzy Hash: a7c9fade0712923ee3ec9ab65136ea134ce3ea05e8ad23584895c2e21141bf4a
                                                                                                                              • Instruction Fuzzy Hash: 09210531E00118BFDB10EFF9AC808EE7BB8EB40368B94066AE514E3151DF345E41CB55
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C098704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • ___initmbctable.LIBCMT ref: 6C098719
                                                                                                                                • Part of subcall function 6C09DA9F: __setmbcp.LIBCMT ref: 6C09DAAA
                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe,00000104,?,?,?,6C09687F), ref: 6C098730
                                                                                                                              Strings
                                                                                                                              • C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe, xrefs: 6C098723, 6C098728
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileModuleName___initmbctable__setmbcp
                                                                                                                              • String ID: C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
                                                                                                                              • API String ID: 2741541922-2796865217
                                                                                                                              • Opcode ID: 737f7720a1e847ccb5308ba0644bae63b599ba43b2d67379a26726950d63a4f7
                                                                                                                              • Instruction ID: 52fddc99b506acd7f46b6376d9a11f23e472c8ea04f83a9587248c74ee11b7d2
                                                                                                                              • Opcode Fuzzy Hash: 737f7720a1e847ccb5308ba0644bae63b599ba43b2d67379a26726950d63a4f7
                                                                                                                              • Instruction Fuzzy Hash: AB21D136A05558BFCB00CAB99880BCEBBFAFB45368B5007AAE425E3741D7309A04DB50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 69747941 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetUserDefaultUILanguage.KERNEL32(?,00000004,ENG,?,?,?,69747E1D,?), ref: 69747957
                                                                                                                              • GetSystemDefaultUILanguage.KERNEL32(?,00000000,?,?,?,69747E1D,?), ref: 697479A2
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DefaultLanguage$SystemUser
                                                                                                                              • String ID: ENG
                                                                                                                              • API String ID: 384301227-257040513
                                                                                                                              • Opcode ID: 65395f61765c82e544b61d6bae62c632a41d8557e985b85cb2b0fa5d33cc1f6d
                                                                                                                              • Instruction ID: 2ad9972048f0da34c2ec21ab021b5ed7b656163432b2275c05a65333066d6c13
                                                                                                                              • Opcode Fuzzy Hash: 65395f61765c82e544b61d6bae62c632a41d8557e985b85cb2b0fa5d33cc1f6d
                                                                                                                              • Instruction Fuzzy Hash: 7D114C72B401547BDF44AF71CE05E6E7A5BFB90F54F218137E20A8B093EB328152C140
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 697482FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _strrchr.LIBCMT ref: 69748306
                                                                                                                                • Part of subcall function 697466CC: CompareStringA.KERNEL32(00000409,00000001,69746892,000000FF,?,000000FF,?,69746723,00000001,inf,69746892,?,697467C5,69746892,69746892,?), ref: 697466E2
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580296124.0000000069741000.00000020.00000001.01000000.00000017.sdmp, Offset: 69740000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580286539.0000000069740000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580307901.000000006975D000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580319097.0000000069761000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_69740000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CompareString_strrchr
                                                                                                                              • String ID: ini$png
                                                                                                                              • API String ID: 987711976-1989627829
                                                                                                                              • Opcode ID: e8307497d8fcdd4b6f229eed59d7d0cfff2eab578eaf204056b9956cb7073f79
                                                                                                                              • Instruction ID: aefc059b2b11205bae10a5d6881b6a0c25d513773deaa2f3a1519d8552480e2d
                                                                                                                              • Opcode Fuzzy Hash: e8307497d8fcdd4b6f229eed59d7d0cfff2eab578eaf204056b9956cb7073f79
                                                                                                                              • Instruction Fuzzy Hash: D6E0867618465B776601A571DF08DDF768CDF52FE47408031A914D6053EF11D61194E5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C0983BF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • DeleteCriticalSection.KERNEL32(0000000C,00000000,?,6C0968D9), ref: 6C0983E0
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CriticalDeleteSection
                                                                                                                              • String ID: `nl$`ol
                                                                                                                              • API String ID: 166494926-1447723215
                                                                                                                              • Opcode ID: 57c5df073acef06efc902d0fdaf7e3a9667ad128108fe473a46b72556fadc31f
                                                                                                                              • Instruction ID: b984b660ce23ff5db8d458827ee7ec8be8cbadf99c26438bd6020b04ce78b2db
                                                                                                                              • Opcode Fuzzy Hash: 57c5df073acef06efc902d0fdaf7e3a9667ad128108fe473a46b72556fadc31f
                                                                                                                              • Instruction Fuzzy Hash: 7AF0A03790811497D7208A58D444749F7E9EF80324F26E62ADAA4D3B40EB34E8869794
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 6C095D97 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              • DirectXSetupIsJapanNec == 0, xrefs: 6C095DB8
                                                                                                                              • DirectXSetupIsJapanNec == 1, xrefs: 6C095DA9
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000012.00000002.580360362.000000006C091000.00000020.00000001.01000000.00000016.sdmp, Offset: 6C090000, based on PE: true
                                                                                                                              • Associated: 00000012.00000002.580348988.000000006C090000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580372925.000000006C0A4000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              • Associated: 00000012.00000002.580382170.000000006C0A7000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_18_2_6c090000_DXSETUP.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: KeyboardType
                                                                                                                              • String ID: DirectXSetupIsJapanNec == 0$DirectXSetupIsJapanNec == 1
                                                                                                                              • API String ID: 1620330385-1182196344
                                                                                                                              • Opcode ID: b0ea914d45aed6461eb0efd88173c7367203c9fc9a29376735a3f2e7b1853c2e
                                                                                                                              • Instruction ID: 1a255df8cdc8cdc491c0fbe4443309b130fb3c1c85c1df2aaa0c2759f46eedd4
                                                                                                                              • Opcode Fuzzy Hash: b0ea914d45aed6461eb0efd88173c7367203c9fc9a29376735a3f2e7b1853c2e
                                                                                                                              • Instruction Fuzzy Hash: 04C08C212AB100213F9061F61E093DA20C64F9008F331BD35B8A2C3F81EF00E12871F1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 00463919 Relevance: 3.0, APIs: 2, Instructions: 27COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • KiUserExceptionDispatcher.NTDLL ref: 0046392D
                                                                                                                              • KiUserExceptionDispatcher.NTDLL ref: 0046393D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001A.00000003.591350562.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_26_3_460000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DispatcherExceptionUser
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 6842923-0
                                                                                                                              • Opcode ID: 6477e3d0c8e182499c7043e57033c1f3fef2aa1892a4b46a9d398204a6d55c97
                                                                                                                              • Instruction ID: f6fc41e558b9956afb4a12f8bf960f34673e6bfc1b5f13ef3675dab250987362
                                                                                                                              • Opcode Fuzzy Hash: 6477e3d0c8e182499c7043e57033c1f3fef2aa1892a4b46a9d398204a6d55c97
                                                                                                                              • Instruction Fuzzy Hash: E9E06D7564A3C06FC70657B1B85C86A7FF8AA8A22131501ABE402CB262C5689805CB61
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00463928 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • KiUserExceptionDispatcher.NTDLL ref: 0046392D
                                                                                                                              • KiUserExceptionDispatcher.NTDLL ref: 0046393D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001A.00000003.591350562.0000000000460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00460000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_26_3_460000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DispatcherExceptionUser
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 6842923-0
                                                                                                                              • Opcode ID: 73b8da9cbf679ec2477656ead60e8371d487dfeca1cb6075046189562f35d766
                                                                                                                              • Instruction ID: 7e02bab52afd4e0529749eb34d1644dda4b920f89d88df48fb622844910071d6
                                                                                                                              • Opcode Fuzzy Hash: 73b8da9cbf679ec2477656ead60e8371d487dfeca1cb6075046189562f35d766
                                                                                                                              • Instruction Fuzzy Hash: 44E08C716403406B860467A6B94C83B37EDEAC9222310042AE406CB310DA74AC018AB1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0017D608 Relevance: .1, Instructions: 75COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001A.00000002.591466633.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_26_2_17d000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 07654c83518df194b0b7f5066f940e38c2b452c652d928563dde8fc3c543b51e
                                                                                                                              • Instruction ID: 0cc1f11d4979dbb74e400de5fc4914c111405a3e98f77d079d779ccb0133c3a5
                                                                                                                              • Opcode Fuzzy Hash: 07654c83518df194b0b7f5066f940e38c2b452c652d928563dde8fc3c543b51e
                                                                                                                              • Instruction Fuzzy Hash: EF21F171604248EFDB05CF14E9C0B26BF75EF98314F24C569E80D0A24AC336D856CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0017D6F4 Relevance: .1, Instructions: 75COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001A.00000002.591466633.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_26_2_17d000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 7573883481a96bc392d3181eb2fa611a693bae54636a217e6bb379de91d0eeef
                                                                                                                              • Instruction ID: 3730598604cef3b9f6fed90e6528f6e0fa8926d890882054a7aa6d9a87e0630b
                                                                                                                              • Opcode Fuzzy Hash: 7573883481a96bc392d3181eb2fa611a693bae54636a217e6bb379de91d0eeef
                                                                                                                              • Instruction Fuzzy Hash: 8421D3B6504248EFDB19CF14E8C0B26BF75EF88328F24C569E8094A246C336D856CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0017D603 Relevance: .1, Instructions: 56COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001A.00000002.591466633.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_26_2_17d000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction ID: 157a36adf04e4ba84f709b2791e251870754ffb8bbe925eb5c1b8e8eff5ce0d3
                                                                                                                              • Opcode Fuzzy Hash: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction Fuzzy Hash: DD11AF76504244DFDB12CF14E9C4B16BF72FB94314F24C5A9E8094B256C336D85ACBA2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0017D6EF Relevance: .1, Instructions: 56COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001A.00000002.591466633.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_26_2_17d000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction ID: dc9c426f0cae140a6da1559b48b8d22582c0638280c28d54e2b0bd5dd886abdd
                                                                                                                              • Opcode Fuzzy Hash: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction Fuzzy Hash: 7811D076504284CFDB16CF14E9C4B16BF71FF84324F28C6A9D8484B616C33AD85ACBA2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0017D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001A.00000002.591466633.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_26_2_17d000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: dc773cc2e6a5608c8ed1875aba7165b531b2f2139c76f8098deb829f9feab9c1
                                                                                                                              • Instruction ID: 3c0d3bce4cc4b337522244d0a99a68915f867ce1ba68bf661f3b760bd47f4e14
                                                                                                                              • Opcode Fuzzy Hash: dc773cc2e6a5608c8ed1875aba7165b531b2f2139c76f8098deb829f9feab9c1
                                                                                                                              • Instruction Fuzzy Hash: 6F018471404348AAE7104E29DCC4B66BFB8DF45764F28D45AFC4D4A286C779D845C6B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0017D006 Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001A.00000002.591466633.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_26_2_17d000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e8d53ed510b80e2d4c06623945d50ce9018ed50c17d8bc699c90682b1b955449
                                                                                                                              • Instruction ID: 1fdd71964c364a02b4cc53666bae5677bd4df67025f177777add1b7984df3ebd
                                                                                                                              • Opcode Fuzzy Hash: e8d53ed510b80e2d4c06623945d50ce9018ed50c17d8bc699c90682b1b955449
                                                                                                                              • Instruction Fuzzy Hash: AC014C6140D3C49FD7128B259C94BA2BFB4DF53224F1DC1DBE8888F2A7C2699848C772
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 00450FB0 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,004512C3), ref: 00451D54
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001C.00000002.654741368.0000000000450000.00000040.00000800.00020000.00000000.sdmp, Offset: 00450000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_28_2_450000_InstallChainer.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ForegroundWindow
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2020703349-0
                                                                                                                              • Opcode ID: 0bea5d2cf83cbc07cdf069df71c5fd09b5bb10fcbbb77f22dd9322474bc3d596
                                                                                                                              • Instruction ID: ba24d505738e08e72515212616728a2dda863158b4398f9a33dd9f34d360b892
                                                                                                                              • Opcode Fuzzy Hash: 0bea5d2cf83cbc07cdf069df71c5fd09b5bb10fcbbb77f22dd9322474bc3d596
                                                                                                                              • Instruction Fuzzy Hash: 5111F5B5C006098FCB10DF99D544BEEBBF4EB49310F20845AD829A7351D379A948CFA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 01CD1630 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: $p$$p
                                                                                                                              • API String ID: 0-580715581
                                                                                                                              • Opcode ID: 89ca585eecd1d0358edde6decae4b9449562eddba95589a45a566d2db6e2681c
                                                                                                                              • Instruction ID: 59f71e81806e8441f93f77f5ab3e532ce50d690e01cee09b160c7c76dd928ff9
                                                                                                                              • Opcode Fuzzy Hash: 89ca585eecd1d0358edde6decae4b9449562eddba95589a45a566d2db6e2681c
                                                                                                                              • Instruction Fuzzy Hash: 0451C035B002059FCB19DFB8D850AAEBBF6FFC9250B19852AD605DB365DA30CD06C7A1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD1080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: d63533e6f8614f99cb2d3950b821df5839d2022706b794544ecdd58be03f7e94
                                                                                                                              • Instruction ID: dc97fe8a8a2c75b6dd6bd72c033e0d3b4f8bb56d3d6700c5c623575c058b5b10
                                                                                                                              • Opcode Fuzzy Hash: d63533e6f8614f99cb2d3950b821df5839d2022706b794544ecdd58be03f7e94
                                                                                                                              • Instruction Fuzzy Hash: BD71D831B00214CFDB09ABB9C854B6EB7A7AFC8310F198029E606DB3A4DE75DD52C791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD0C1C Relevance: 1.4, Strings: 1, Instructions: 156COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: 5a75191dc7b2ccf7c52f2ae189ef8dc50d20922054ac005b46769f0c29ae350b
                                                                                                                              • Instruction ID: f012ba9816d6cda232ba6adef90f2a7650c5032f681603fa538dd5369f959a31
                                                                                                                              • Opcode Fuzzy Hash: 5a75191dc7b2ccf7c52f2ae189ef8dc50d20922054ac005b46769f0c29ae350b
                                                                                                                              • Instruction Fuzzy Hash: E75125306042859FDB199B68D8147AE7FF2AFC9310F18406ED606E7291DE748C09C7A2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD0C48 Relevance: 1.3, Strings: 1, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: PXF
                                                                                                                              • API String ID: 0-2116076635
                                                                                                                              • Opcode ID: 83e49ce623eaead9e8c7230f981e6100b7001ed698b3f42fb0c0665038d4e400
                                                                                                                              • Instruction ID: d6ec0c9affbdeec70a58da7c92f64576cdcd043d17ae47fed1bfdb69d6fbe176
                                                                                                                              • Opcode Fuzzy Hash: 83e49ce623eaead9e8c7230f981e6100b7001ed698b3f42fb0c0665038d4e400
                                                                                                                              • Instruction Fuzzy Hash: 62D0A7713506259BC604626CE054969339CDF49715B40046AF209CB321CA51DC0003C5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD23B8 Relevance: .2, Instructions: 206COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 208dc53eddaba36828be4386e0a05a7d7d43c5738c8b3b442978e9c44a119dfb
                                                                                                                              • Instruction ID: aca7f1a06b32d1ceab73dc61ad8f85fb74252dcb75b22daf9cf832a3e1b0ccc0
                                                                                                                              • Opcode Fuzzy Hash: 208dc53eddaba36828be4386e0a05a7d7d43c5738c8b3b442978e9c44a119dfb
                                                                                                                              • Instruction Fuzzy Hash: 2B613635700651CFC715DB2CD894AAEBBB1EF89314B1481AADA05CB3A2EB31DC42C791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD0FFF Relevance: .1, Instructions: 130COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 2b92a2a788a5f4e51394fd7e7140a5100fd06d454d44c56222bb70a2b4266823
                                                                                                                              • Instruction ID: e1e597476d54833f49200294aef60cf7c9f001156324c23bec0198f2b54c79d6
                                                                                                                              • Opcode Fuzzy Hash: 2b92a2a788a5f4e51394fd7e7140a5100fd06d454d44c56222bb70a2b4266823
                                                                                                                              • Instruction Fuzzy Hash: 66417E72B04390DBDB16A77A98947BEBFAA9F85250F0C40BBD706C7252EA24DD05C352
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD2268 Relevance: .1, Instructions: 106COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 4afdb76fe9f52f4ed537ae40b3cbf8598f162661dc4d11bb002fca279f68607e
                                                                                                                              • Instruction ID: a8c671c67e1ab2d6f115fd9fd84396134e40f943b6b579d52032171f30d9708e
                                                                                                                              • Opcode Fuzzy Hash: 4afdb76fe9f52f4ed537ae40b3cbf8598f162661dc4d11bb002fca279f68607e
                                                                                                                              • Instruction Fuzzy Hash: 8D41F635B10214DFCB54DF68D98099EBBB6FF8C610B14816AEA05EB364DB31DD52CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD0F20 Relevance: .1, Instructions: 64COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 9768d3d1c5ca2820863d6632166a62d4bb4fe19ef14d691ea346d96ee6fbbcd7
                                                                                                                              • Instruction ID: 4824b43074e559bd9340015c4e378f50538388eee0c911847de65de57e5a66d0
                                                                                                                              • Opcode Fuzzy Hash: 9768d3d1c5ca2820863d6632166a62d4bb4fe19ef14d691ea346d96ee6fbbcd7
                                                                                                                              • Instruction Fuzzy Hash: 4501B131B09361AFCB26677E589462F7F599FD2210F1904BBEB09C7202ED64CC0183E1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD1958 Relevance: .1, Instructions: 58COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: fcec3e7a1976d73dac8a42f83070525ce7447e94f9d166c8e1fe8fa54a63c7b9
                                                                                                                              • Instruction ID: e55fc39fd3e4421153e2cba711c8533cd3ab258032d75de9f813d7636afe2b10
                                                                                                                              • Opcode Fuzzy Hash: fcec3e7a1976d73dac8a42f83070525ce7447e94f9d166c8e1fe8fa54a63c7b9
                                                                                                                              • Instruction Fuzzy Hash: 55216034600284AFCB08CB64D854BE9BFF2AF8C320F184069D909A7265DEB59885CB95
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD1380 Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 7369ec78da6c405cfb7507825866ee53cf1905c9b65ae47d21ef54107b25d71a
                                                                                                                              • Instruction ID: be1ce77a23e326c505d2f8949397e8ed4bf480f4932ca0c4e575ce975445b28d
                                                                                                                              • Opcode Fuzzy Hash: 7369ec78da6c405cfb7507825866ee53cf1905c9b65ae47d21ef54107b25d71a
                                                                                                                              • Instruction Fuzzy Hash: 8F11E3B1D002098BDB14DFAAC484AAEFBF4EF48324F14842AD51967240C775A945CFA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD1968 Relevance: .1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0a07e7147fe875040cd53b4b14aae927a4717a7b895361aecb415a124ae79ecf
                                                                                                                              • Instruction ID: c0820d33318144e6f5f82acb0805176c7ed43b4301b0cebda1e566267dead70a
                                                                                                                              • Opcode Fuzzy Hash: 0a07e7147fe875040cd53b4b14aae927a4717a7b895361aecb415a124ae79ecf
                                                                                                                              • Instruction Fuzzy Hash: 21118F30600644EFCB08DF64D854AA97BF6EF8C320F144039E80AE7365DFB19885CBA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD1440 Relevance: .1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 2bc2c22d45aa28e41fe2d069bfefed8405971ee42475df9d1427ac6cc3757ad6
                                                                                                                              • Instruction ID: aaca9807f4ce92cf6bde919fe27cf6b177a0bbc14a7d425ca66c9b94c12545e5
                                                                                                                              • Opcode Fuzzy Hash: 2bc2c22d45aa28e41fe2d069bfefed8405971ee42475df9d1427ac6cc3757ad6
                                                                                                                              • Instruction Fuzzy Hash: 9E0175706093865FDB0AD7785C7122ABFEAADC220470D05BAC64ADB167E954C808C7D2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0036D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000002.601340040.000000000036D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0036D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_2_36d000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c4df456aa2a96b4d267ff3256831374861408c7d3d23d5eae3b61c4c83889669
                                                                                                                              • Instruction ID: 085d4e47b1cdc3efa715872a6bfba34ceac3cb4497980f2baeacacd2971abed2
                                                                                                                              • Opcode Fuzzy Hash: c4df456aa2a96b4d267ff3256831374861408c7d3d23d5eae3b61c4c83889669
                                                                                                                              • Instruction Fuzzy Hash: 9301D071904340AAD7114E15CCC4767BFECDF45724F28C41ADC454F54AC679D845C6B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD1BB0 Relevance: .0, Instructions: 39COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 6b2ef01d200f56f3a7ae132bf8e3649607dc44a066733bf24a17da55685d7e43
                                                                                                                              • Instruction ID: 2407d40bcffa879f247a0f58ca13c301792d64d9be9ac76d93770092cc84d6c0
                                                                                                                              • Opcode Fuzzy Hash: 6b2ef01d200f56f3a7ae132bf8e3649607dc44a066733bf24a17da55685d7e43
                                                                                                                              • Instruction Fuzzy Hash: B8F02B757093906FC726566D549076F6F555FD5160F1900EAEE4487212EA64CD018290
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0036D01C Relevance: .0, Instructions: 36COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000002.601340040.000000000036D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0036D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_2_36d000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8a16bc296a8ff7535d01da9036bd6f5f391fe49849c167c5500d36036f622609
                                                                                                                              • Instruction ID: e9146e19c540f1f9d4a10047ec7a7bc08d3245f58beb2e6c22972783c2f129f8
                                                                                                                              • Opcode Fuzzy Hash: 8a16bc296a8ff7535d01da9036bd6f5f391fe49849c167c5500d36036f622609
                                                                                                                              • Instruction Fuzzy Hash: 70F068719043449EE7118E16CCC4B66FFE8EB41724F28C55AED484E24AC2799C44CAB1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD17F0 Relevance: .0, Instructions: 21COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 9ada9d32475b274e4d4f64ff16535b8b4ddb5686b724b539320b1af125c8ae21
                                                                                                                              • Instruction ID: 0d95ffcd947dde9a575e5459ea8f2f9f917c2f272817abc0a06cb3716976fa2c
                                                                                                                              • Opcode Fuzzy Hash: 9ada9d32475b274e4d4f64ff16535b8b4ddb5686b724b539320b1af125c8ae21
                                                                                                                              • Instruction Fuzzy Hash: 0AE0273754D1D05FC3065724B9504ED3FB55B6B11130D0057F582C7273C5514C16D791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD0C0C Relevance: .0, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e8634b53a7c1348831e36ba3f5ce520345e1ae5c91042b8ed4b8353edaa19227
                                                                                                                              • Instruction ID: 317077e2a7c3987f8c4537f65608cc1061fe1b9cc0f2f3de40f020174aeef6ae
                                                                                                                              • Opcode Fuzzy Hash: e8634b53a7c1348831e36ba3f5ce520345e1ae5c91042b8ed4b8353edaa19227
                                                                                                                              • Instruction Fuzzy Hash: FED0A77225061CAF42186659E84596A775EEB993A07504433FA01C3225DE609C558396
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD0440 Relevance: .0, Instructions: 13COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 867c28a6cb11c7f474d3e3a33a9a6045cec09ba4e7c1a06a5772c3d03e157bf7
                                                                                                                              • Instruction ID: 25a15fc49de71cb6a753a75510f40bd3f70e74866b43310844253006d403945c
                                                                                                                              • Opcode Fuzzy Hash: 867c28a6cb11c7f474d3e3a33a9a6045cec09ba4e7c1a06a5772c3d03e157bf7
                                                                                                                              • Instruction Fuzzy Hash: FDD0127352D3C0CFC747C25D18A4891BF217D6311578D83D7D2848A523E25AC457D7A6
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 01CD0E7C Relevance: .0, Instructions: 8COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001D.00000003.601113918.0000000001CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_29_3_1cd0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: a16838b0d4b252dbe226135a8f8939395dcc599da51df23576f14ea68dea3344
                                                                                                                              • Instruction ID: b24e9d21e616d52e86f800d6310ef22f2bccb3f7dc273a8dc6f32347fb7cfaa9
                                                                                                                              • Opcode Fuzzy Hash: a16838b0d4b252dbe226135a8f8939395dcc599da51df23576f14ea68dea3344
                                                                                                                              • Instruction Fuzzy Hash: 65B012C5514205F24214A63A44D072F008A9BC0200BC4CC513101940095A68CC011105
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 004D1630 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: $p$$p
                                                                                                                              • API String ID: 0-580715581
                                                                                                                              • Opcode ID: b27af5f3d14ef17b1c12f281f2aa15260f3ddcd86e6cff161321b2d13a684516
                                                                                                                              • Instruction ID: 7addd8f913011eaeb4da4dcf0e7add68f8290076866cd09de4191fa02b46707c
                                                                                                                              • Opcode Fuzzy Hash: b27af5f3d14ef17b1c12f281f2aa15260f3ddcd86e6cff161321b2d13a684516
                                                                                                                              • Instruction Fuzzy Hash: F551E031B00205AFCB19DFB8D8606AEBBF6AFC9310B14852BD805DB365DA34CC06C791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D0E8C Relevance: 2.6, Strings: 2, Instructions: 147COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p$x];
                                                                                                                              • API String ID: 0-253028394
                                                                                                                              • Opcode ID: b54d22bc0bb6e386273dcda4dfd4b2a188edb07245cd1d7abefbc6106114df7d
                                                                                                                              • Instruction ID: a3baafdf494249f4f384c567d666a14e53b6efebedcbc798b3ae5550ae57fb35
                                                                                                                              • Opcode Fuzzy Hash: b54d22bc0bb6e386273dcda4dfd4b2a188edb07245cd1d7abefbc6106114df7d
                                                                                                                              • Instruction Fuzzy Hash: 96412431B002146BD719A769D8B5B7F7A9ADFD8305F14802FEA06DB391CE789C068399
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D1080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: f36a5a89db9d8ba10c2a0718e36a2d886c255566331ca5b48a414fd0a5211a25
                                                                                                                              • Instruction ID: 8cda082709fcb77ab7e30dbd33bf65e5d4c947c9cb609828e1fc62e5f874ccdb
                                                                                                                              • Opcode Fuzzy Hash: f36a5a89db9d8ba10c2a0718e36a2d886c255566331ca5b48a414fd0a5211a25
                                                                                                                              • Instruction Fuzzy Hash: E271C735B002149FDB09ABB5C864B6EB6E7AFC8304F15812BE906DB3A5DE35DD028745
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D0C1C Relevance: 1.4, Strings: 1, Instructions: 105COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: e92158940e6230b55e23cde18f18540019fcaf0fe14ae166ad32947ef35bc324
                                                                                                                              • Instruction ID: e867a3a6a31e96fd240040d7b8f1cc443b85fa9e9e5de99828b44d1df43302a6
                                                                                                                              • Opcode Fuzzy Hash: e92158940e6230b55e23cde18f18540019fcaf0fe14ae166ad32947ef35bc324
                                                                                                                              • Instruction Fuzzy Hash: 2231E6347083446FD716A769883537E3BA69BC6304F2444AFE946DB392CE785C0A93A6
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D0C48 Relevance: 1.3, Strings: 1, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: PX;
                                                                                                                              • API String ID: 0-1351928282
                                                                                                                              • Opcode ID: c8744ebc778a13a4b338644f3b221568f4308ef51f47331616099ed80abd052f
                                                                                                                              • Instruction ID: 9130c2393ca507b70b54bb1742fec48f0462ed9f4e5c656ff46f9288432c11d3
                                                                                                                              • Opcode Fuzzy Hash: c8744ebc778a13a4b338644f3b221568f4308ef51f47331616099ed80abd052f
                                                                                                                              • Instruction Fuzzy Hash: C7D023713506259FC705576CF054A6D339CDF4D716750046BF209CB321CD51DC0003C5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D23B8 Relevance: .2, Instructions: 203COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 8f545804d4176b44804f78d670c92905531d235ba8eb194daf61fd4ca06454ae
                                                                                                                              • Instruction ID: 0a94ace961cee4475766edcc2f059023c6f18c4b1a728e7e1aff4e161554be8f
                                                                                                                              • Opcode Fuzzy Hash: 8f545804d4176b44804f78d670c92905531d235ba8eb194daf61fd4ca06454ae
                                                                                                                              • Instruction Fuzzy Hash: E46151353046118FC705DB28D9B8A2BBBF5FF85708B1481ABE904CB3A2DA75DC42C795
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D0FFF Relevance: .1, Instructions: 130COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 631d0b50da14be662f32a4b0b530965db30728a19960e2c0d665fa4199757cba
                                                                                                                              • Instruction ID: 2c70c9d971ac7809b3e36e7ca1822a04dbd0e8dc90d823c55a0710b451b5d321
                                                                                                                              • Opcode Fuzzy Hash: 631d0b50da14be662f32a4b0b530965db30728a19960e2c0d665fa4199757cba
                                                                                                                              • Instruction Fuzzy Hash: 52416E32708340ABCB169B669CB47BF7BA99FD5354F04406FDE06C73A2DA688C428356
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D2268 Relevance: .1, Instructions: 106COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 1a12018d57b6de0db0a8e1a91b5e1b0b7acd15bad7bc5dcf69cc55e53e564f36
                                                                                                                              • Instruction ID: 36fef72e1f667cb4f3309c3844d759bd5a046f5e919b10006e86396fed58d135
                                                                                                                              • Opcode Fuzzy Hash: 1a12018d57b6de0db0a8e1a91b5e1b0b7acd15bad7bc5dcf69cc55e53e564f36
                                                                                                                              • Instruction Fuzzy Hash: 2D411835B001049FCB54DF79D99499EB7B2FF88714B10816AE905EB364DB31DC42CB94
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D0F20 Relevance: .1, Instructions: 64COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 3a3ba32f4d3652a7ac0c7571924e4b1e33d18f0e0e192d943678af36be900049
                                                                                                                              • Instruction ID: c9edf5c0c4145b2502b45c4bacc542c5b78c4112fe285e1ccd0187243e499d48
                                                                                                                              • Opcode Fuzzy Hash: 3a3ba32f4d3652a7ac0c7571924e4b1e33d18f0e0e192d943678af36be900049
                                                                                                                              • Instruction Fuzzy Hash: 20016B21B553543BCB26637A58B471F7F9D9F82B54F11046BEE04CB312ED189C0182A9
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D1380 Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 39a451d37d2453328edcbf9899d92047975831f8dbca4629bbf90ed6755ef8f1
                                                                                                                              • Instruction ID: 916c0b762f47ee55eab9d56c56ff06e8aa56d2d9f835315e6b6fb1387819bd1c
                                                                                                                              • Opcode Fuzzy Hash: 39a451d37d2453328edcbf9899d92047975831f8dbca4629bbf90ed6755ef8f1
                                                                                                                              • Instruction Fuzzy Hash: 1C11F475D002099BDB10DFAAC884BEEFBF4FF48324F10842AD81967650C775A945CFA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D1968 Relevance: .1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 59b9ff4eab453d139bd1044fbf47d8877422befe0d8eafa0ffd63a00f92ebac9
                                                                                                                              • Instruction ID: b7a1025286524a6defa7a0019d9115f3310c522ef1ae8438bcd812a00cfbe596
                                                                                                                              • Opcode Fuzzy Hash: 59b9ff4eab453d139bd1044fbf47d8877422befe0d8eafa0ffd63a00f92ebac9
                                                                                                                              • Instruction Fuzzy Hash: 54119430604604AFC745DF55D854BAD7BBAEF8C314F104119D909A73A0CF759C89CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001AD006 Relevance: .0, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000002.602603383.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_2_1ad000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 14823a43a8d82b2cb34b9b99a44998a562493d1f7318a33184ec85084476a7f2
                                                                                                                              • Instruction ID: 2e6f76d3e0d4f7190f3beb74a80520328a1a48397767928f903378935d86f718
                                                                                                                              • Opcode Fuzzy Hash: 14823a43a8d82b2cb34b9b99a44998a562493d1f7318a33184ec85084476a7f2
                                                                                                                              • Instruction Fuzzy Hash: AE019E6140D3C09FD7134B259C98762BFB8EF53624F1984DBE8858F6A7C2689C49C772
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001AD01D Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000002.602603383.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_2_1ad000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 4b65fe4a9afd9c73e50854211f3ef3494b8ca494549b128b2b04c6731c364b1b
                                                                                                                              • Instruction ID: a1d32bd28fa5755a006ef98c2f9901aef09bb35e28973fe35b4b70b59de5028b
                                                                                                                              • Opcode Fuzzy Hash: 4b65fe4a9afd9c73e50854211f3ef3494b8ca494549b128b2b04c6731c364b1b
                                                                                                                              • Instruction Fuzzy Hash: 19014774404740AAE7104E25DDC4B6BBFD8EF42724F28C01AFC460B686C379D845C6B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D1440 Relevance: .0, Instructions: 42COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 64e28c5927edd4f18a8d5f610b85cb29a6979820ca394ae9b8b98a790d9b9b2d
                                                                                                                              • Instruction ID: 4acfffdffa966ea84609754b8dca8f5793a56ee6b3c638f81b436f348fc65df8
                                                                                                                              • Opcode Fuzzy Hash: 64e28c5927edd4f18a8d5f610b85cb29a6979820ca394ae9b8b98a790d9b9b2d
                                                                                                                              • Instruction Fuzzy Hash: 540167706093865FC70AEB389C753297FB9EEC230870905ABC645CF276D9249808C791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D1BB0 Relevance: .0, Instructions: 39COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 059b188093e477cee8642ba66c0ecb3a64d5365636e08802bbd645fec4ddf12d
                                                                                                                              • Instruction ID: 71970ad973fd4a2f16c9bc2a430a7be27521109f5e81e673084fe1b8943845ad
                                                                                                                              • Opcode Fuzzy Hash: 059b188093e477cee8642ba66c0ecb3a64d5365636e08802bbd645fec4ddf12d
                                                                                                                              • Instruction Fuzzy Hash: CBF02B717093503BC725576654E071B7F9D9F967A0F1500ABED44CB312E6688C0082A4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D1FE0 Relevance: .0, Instructions: 30COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d15cbc33b4507933bc6d276f67ef0ac08e3aeba2c9002249168be88b171b318a
                                                                                                                              • Instruction ID: 0d9d98c3afb19a95c17ae57ce23c43be1bb405695d074271492b3cc58f5917e6
                                                                                                                              • Opcode Fuzzy Hash: d15cbc33b4507933bc6d276f67ef0ac08e3aeba2c9002249168be88b171b318a
                                                                                                                              • Instruction Fuzzy Hash: EFE09222704645178733965758A5B9F6B4ADFA1264F28007FEA09C7322C9A8CC45C2A9
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D17F0 Relevance: .0, Instructions: 21COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d0b876bbe2324ee354f64b2f263b6b7bac263fa3bcbdcd2ef7e3f1f7f15a6411
                                                                                                                              • Instruction ID: ec88fd731356cf9c9e0835326a889a183e3319747685ad8a48b3215efabc6340
                                                                                                                              • Opcode Fuzzy Hash: d0b876bbe2324ee354f64b2f263b6b7bac263fa3bcbdcd2ef7e3f1f7f15a6411
                                                                                                                              • Instruction Fuzzy Hash: D9E0C23212D2541FC306A764E8584557FB8DB4B21030400ABE941CB2B7DD245C95C795
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D0C0C Relevance: .0, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b1e9f5b3d196adcea45341b984b53a8b608c38ce1c482869f7dc6116c10d7275
                                                                                                                              • Instruction ID: c8a377e0225a8ef4ee5274a9f5f052c073e97e8ba4981c896e9e54a17e042f71
                                                                                                                              • Opcode Fuzzy Hash: b1e9f5b3d196adcea45341b984b53a8b608c38ce1c482869f7dc6116c10d7275
                                                                                                                              • Instruction Fuzzy Hash: E2D0A73631451C6F42157759D855A6A779DEB453603504437FA0183325CE645C05979A
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D0440 Relevance: .0, Instructions: 12COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d430dd08839e41396f5d005b574f21f873ac500f68504bcaca9e0ec38f9748fb
                                                                                                                              • Instruction ID: ca2f198ad2a9d913ad35ede58f3cb9f20ed8ae43690096b5dead34da65db599f
                                                                                                                              • Opcode Fuzzy Hash: d430dd08839e41396f5d005b574f21f873ac500f68504bcaca9e0ec38f9748fb
                                                                                                                              • Instruction Fuzzy Hash: 87D0C93005D2805FC7038B608C548953F74BAA630171586A6E081CA062C3294955D722
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D0E7C Relevance: .0, Instructions: 8COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b7fb2346e63b15c54dcf4079550bb3476184bcd121b7c78f148c7595c2dba4e2
                                                                                                                              • Instruction ID: 2d8b0130f380e6f16227648e3dde6de1db52d36a54cbab52421121375cbf8da1
                                                                                                                              • Opcode Fuzzy Hash: b7fb2346e63b15c54dcf4079550bb3476184bcd121b7c78f148c7595c2dba4e2
                                                                                                                              • Instruction Fuzzy Hash: 61B01289514204324225A73648B172A00869AC1304BD0CC1B35019011A4D5CD8011009
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004D1B98 Relevance: .0, Instructions: 7COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001E.00000003.602474320.00000000004D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_30_3_4d0000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b4c350bd79fa2ef4ef47b2b2fa47ed82d1e11b4d4309e38fea31fd7f4c90613b
                                                                                                                              • Instruction ID: 5563f4548eb45f1b80189a7629649f6829f2761e1dbb17b407a1f2cf1da1f9ec
                                                                                                                              • Opcode Fuzzy Hash: b4c350bd79fa2ef4ef47b2b2fa47ed82d1e11b4d4309e38fea31fd7f4c90613b
                                                                                                                              • Instruction Fuzzy Hash: 81B012652000001B5301EB324C80A1D31136EC1541794C4695400CF007C778C0021204
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 00441630 Relevance: 2.7, Strings: 2, Instructions: 158COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: $p$$p
                                                                                                                              • API String ID: 0-580715581
                                                                                                                              • Opcode ID: e0da644c9fd5dc87940e86998d13551424edaf2a32cee9c1e09b225f54f0d23a
                                                                                                                              • Instruction ID: 2a0a06d54f182bdda93d614b56e226d6552fe8ef957cee8dfd6bb63ffdf1f2db
                                                                                                                              • Opcode Fuzzy Hash: e0da644c9fd5dc87940e86998d13551424edaf2a32cee9c1e09b225f54f0d23a
                                                                                                                              • Instruction Fuzzy Hash: 7651EF35B002049FEB19DFB8D8806AEBBF6AFC9310B24852BD405DB365DA34CD46CB91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00441080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: 4f6e1b95379ae57cc50539eadecaeb3cbbdd6087e707b587b821f7f9a3ce5ff9
                                                                                                                              • Instruction ID: e0be21300bd095fcf2284883267e6084c0cf27753ee6aa22719de805bdcfa149
                                                                                                                              • Opcode Fuzzy Hash: 4f6e1b95379ae57cc50539eadecaeb3cbbdd6087e707b587b821f7f9a3ce5ff9
                                                                                                                              • Instruction Fuzzy Hash: D1712D31B102148FEB08ABB5C85476E77A7AFC8300F19802AE506DB3A4DE74DD52CB41
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00440C1C Relevance: 1.4, Strings: 1, Instructions: 154COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: 0eca8ba2fe8268328ec5592946fbbe7cbb51a004e265aea35ad4b82993b278e6
                                                                                                                              • Instruction ID: 4f11cb97884af2117d1c7a92653881ce3f581dee6800477509bd4abfaf163f34
                                                                                                                              • Opcode Fuzzy Hash: 0eca8ba2fe8268328ec5592946fbbe7cbb51a004e265aea35ad4b82993b278e6
                                                                                                                              • Instruction Fuzzy Hash: 6C514830A142949FEB15DB64D8687AE7FB2AFC9314F14406EE406DB392CE784C4AC7A1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00440C48 Relevance: 1.3, Strings: 1, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: PX.
                                                                                                                              • API String ID: 0-1028205873
                                                                                                                              • Opcode ID: 33713538e5db53aeb98c648ddbb4c353af798c9d429012c776a40c2cf9c03c0e
                                                                                                                              • Instruction ID: 2f82d665daff9e87718731bfce184320fd0c1288c9eefcc9106c88edf2a340fd
                                                                                                                              • Opcode Fuzzy Hash: 33713538e5db53aeb98c648ddbb4c353af798c9d429012c776a40c2cf9c03c0e
                                                                                                                              • Instruction Fuzzy Hash: 16D0A7313A06245FD604A65CE054959379DDF49716750046AF109CB321C951DC0003C5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004423B8 Relevance: .3, Instructions: 251COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 1020ccca7d86e9b3902d679ac2f2ec2cb360115b4de9db8980564c279cc06502
                                                                                                                              • Instruction ID: 5a2e7bf4f9c5b4410c03a27cd1c8ddfdad89d67b1b69f9895c19a961cb1e6fd4
                                                                                                                              • Opcode Fuzzy Hash: 1020ccca7d86e9b3902d679ac2f2ec2cb360115b4de9db8980564c279cc06502
                                                                                                                              • Instruction Fuzzy Hash: D2815531B042518FD714DB78D894A6FBBF5EF85314B5481ABE909CB3A2DA78CC42CB91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00442268 Relevance: .1, Instructions: 106COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 57225ad39ca0c5e5a49d47e82ffbc1b953a26f479a047e2e76fd9277a08a070e
                                                                                                                              • Instruction ID: a8e15230fc1242fb2560f929075c258ffbcc559554f6e36ba99d01d52f7223d4
                                                                                                                              • Opcode Fuzzy Hash: 57225ad39ca0c5e5a49d47e82ffbc1b953a26f479a047e2e76fd9277a08a070e
                                                                                                                              • Instruction Fuzzy Hash: C1413635B00208DFCB44EF68D98499EBBB6FF88310B10816AE905EB320DB31DC42CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00441958 Relevance: .1, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: f0259d29aeaf72881a37de53b73d4d7d262fcf73a4ed2416865b97ed35acdef9
                                                                                                                              • Instruction ID: 991fe55ee56e2712c008d77dc93d9dc65271bf1b4620b6cb4aa6066cb3ce5907
                                                                                                                              • Opcode Fuzzy Hash: f0259d29aeaf72881a37de53b73d4d7d262fcf73a4ed2416865b97ed35acdef9
                                                                                                                              • Instruction Fuzzy Hash: B12187346501949FCB05CF64E89CAED7FB2EF8D314F144019E85AAB3A1CB75588ACB60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00441380 Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 92f465b81dbe29b4bce870713b1de62c53b06d5698ee1470e58048e2a8b421a4
                                                                                                                              • Instruction ID: 090a65d14400e9a4ee03aa0187a5167fbe928147e79fde6447a6836f1c5f0d9a
                                                                                                                              • Opcode Fuzzy Hash: 92f465b81dbe29b4bce870713b1de62c53b06d5698ee1470e58048e2a8b421a4
                                                                                                                              • Instruction Fuzzy Hash: DD11F471D002098BDB10DFAAC484BEEFBF4FF88324F10842AD81967250C774A945CFA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00441968 Relevance: .1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 605fcf83cc44e88741d5b48105f101b99566d7f3b78e6fcf14e78d306581da6f
                                                                                                                              • Instruction ID: a2ee8f73dcdf7cc5af89de65e1b6a8b819171c6bc7cedb66c5219ec5e4a9e316
                                                                                                                              • Opcode Fuzzy Hash: 605fcf83cc44e88741d5b48105f101b99566d7f3b78e6fcf14e78d306581da6f
                                                                                                                              • Instruction Fuzzy Hash: 61118230650294AFDB04DF54E89CAA97BB6EF8C315F144019E409AB3A1CF759885CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00441440 Relevance: .0, Instructions: 50COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e0a05d94e28bf323d9a496a07c2ec86786fc3cff4da185184e2c2097ed856079
                                                                                                                              • Instruction ID: 712267df29f8e65407bd800302eea64846a13b71270fc42f9452a843930692d4
                                                                                                                              • Opcode Fuzzy Hash: e0a05d94e28bf323d9a496a07c2ec86786fc3cff4da185184e2c2097ed856079
                                                                                                                              • Instruction Fuzzy Hash: 5701B9306193C60FDF09DB38ACB522A7FA59DC231430904ABE449CF177E9148808C791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0018D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000002.604109071.000000000018D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0018D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_2_18d000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: beebf0e22f611a929d76bc92a2d04316a02f4a8b6f2f42f2b342b63250cc699b
                                                                                                                              • Instruction ID: 7f324ced68c0a706c47838b738fff6573dd88b46c5b9b499518fa21cdce7f1da
                                                                                                                              • Opcode Fuzzy Hash: beebf0e22f611a929d76bc92a2d04316a02f4a8b6f2f42f2b342b63250cc699b
                                                                                                                              • Instruction Fuzzy Hash: 94018471408344AAE7146E26ECC4B66BF98DF41724F28845AFC494A2C6C779D945CBB1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0018D01C Relevance: .0, Instructions: 36COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000002.604109071.000000000018D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0018D000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_2_18d000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: dd95a98a5b8344bf79eb088b2b74f5c7947bba0a91ba63008637579097712f2c
                                                                                                                              • Instruction ID: 6dab56fa98921b3286f96c33a7501ce3bb4c8f1b9a1b2ab875b566e939546e5f
                                                                                                                              • Opcode Fuzzy Hash: dd95a98a5b8344bf79eb088b2b74f5c7947bba0a91ba63008637579097712f2c
                                                                                                                              • Instruction Fuzzy Hash: F1F0C271404344AEE7108E16DCC4B62FFD8EB41724F28C45AFC484E286C3799C44CBB0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 004417F0 Relevance: .0, Instructions: 20COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: e01fcf27b07f2a44d6581dc8e2c665a364fe22b1ffd85303296019e7312233f3
                                                                                                                              • Instruction ID: 260c169cf5f8bef81a7c1a831f110897cd3571802c67290c494150c953c07d44
                                                                                                                              • Opcode Fuzzy Hash: e01fcf27b07f2a44d6581dc8e2c665a364fe22b1ffd85303296019e7312233f3
                                                                                                                              • Instruction Fuzzy Hash: 32E02B3A25D2800FC3069770B8554A97F749B57220318419FE942CB2B7CC6C0C5AC791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00440C0C Relevance: .0, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d66196bfa4c1bc46e8d4876b99cc19d1a1ac6bb8451c3daee58e6dba1a981f18
                                                                                                                              • Instruction ID: 001e950ca039c6362a7189651e575f096f3caf7a5b3640fad85b900a79318ce8
                                                                                                                              • Opcode Fuzzy Hash: d66196bfa4c1bc46e8d4876b99cc19d1a1ac6bb8451c3daee58e6dba1a981f18
                                                                                                                              • Instruction Fuzzy Hash: 95D0233233011CAF43043309E88596A3B5CEB443603B04433FA01C3332CD349C1183D9
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00440440 Relevance: .0, Instructions: 14COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 0000001F.00000003.603967718.0000000000440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00440000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_31_3_440000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: ad8d1194770860d6a95a63f1978925df1e0c244843195847f3a36eda76f8a033
                                                                                                                              • Instruction ID: cd0246514c38fc5f0f850f42c67066173b0b6d147c49a3cb1a042fd247805aa7
                                                                                                                              • Opcode Fuzzy Hash: ad8d1194770860d6a95a63f1978925df1e0c244843195847f3a36eda76f8a033
                                                                                                                              • Instruction Fuzzy Hash: 28D012665AD3C08FC703466458908D52F60A96321038D83D7C9808F567911D8C6BD232
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 001FD608 Relevance: .1, Instructions: 75COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000020.00000002.611830908.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_32_2_1fd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d061b120c254e3e6d742f0a4b86a8a01149b5fcaddf113e480b99837fc5165fa
                                                                                                                              • Instruction ID: 53b163d3962fab44ee439bc094a2df17c6f22a6794dcb17bd77e614b03929d6c
                                                                                                                              • Opcode Fuzzy Hash: d061b120c254e3e6d742f0a4b86a8a01149b5fcaddf113e480b99837fc5165fa
                                                                                                                              • Instruction Fuzzy Hash: B0212871504244DFDB05CF14E9C0B36BF66FB98324F248569E9098B246C336D856CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001FD6F4 Relevance: .1, Instructions: 75COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000020.00000002.611830908.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_32_2_1fd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 42e222f433e97e0e91c1c4eb121f9395720442009723f0f443cc17c2ae0b6bb7
                                                                                                                              • Instruction ID: 085a78d660c74b31902310148fa3ff3c3452dc55e0d3064f98838e7fca311b93
                                                                                                                              • Opcode Fuzzy Hash: 42e222f433e97e0e91c1c4eb121f9395720442009723f0f443cc17c2ae0b6bb7
                                                                                                                              • Instruction Fuzzy Hash: F6210676504244EFDB05EF14E8C0B36BF66EB88318F24C669EA054E246C336D856DBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001FD603 Relevance: .1, Instructions: 56COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000020.00000002.611830908.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_32_2_1fd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction ID: d8492b02e5716d134f4c4069224b0b1957b635961dcda48177e43c1d60dad914
                                                                                                                              • Opcode Fuzzy Hash: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction Fuzzy Hash: D111D376504244DFDB12CF14E9C4B26BF72FB94324F28C5A9D9094B256C336D85ACBA2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001FD6EF Relevance: .1, Instructions: 56COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000020.00000002.611830908.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_32_2_1fd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction ID: c9ac45de381e7a3ef14be1d897946379fccff851143a40b2622db3a5404e3322
                                                                                                                              • Opcode Fuzzy Hash: 217211c8189b80c6eb57919db5956f046ab66452200442737b66d26eb442fbf2
                                                                                                                              • Instruction Fuzzy Hash: 7E11D376504284CFDB12DF10D9C4B26BF72FB84324F28C6A9D9094F616C336D85ACBA2
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001FD01D Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000020.00000002.611830908.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_32_2_1fd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: edf624f02ac290545c6358b42efd2954920557e8797c11375095c2639bd29cbc
                                                                                                                              • Instruction ID: 8d7fc92489294408dad1f34e3afb39a2382fb9fcb84810ac872fa73e0c6ef228
                                                                                                                              • Opcode Fuzzy Hash: edf624f02ac290545c6358b42efd2954920557e8797c11375095c2639bd29cbc
                                                                                                                              • Instruction Fuzzy Hash: D501A771408348AAE7209E25ECC4B77BFD9EF41724F28C51AFE454B286CB79D845C6B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001FD006 Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000020.00000002.611830908.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_32_2_1fd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: ceb41b2cd961f35b79dfd21e906e001bb944daf11e699655d42e90cc4a1ee729
                                                                                                                              • Instruction ID: d1e0d26abbfdc3c0576b7b93f49a6875ad664ecfc9e32d7a59d252d1112bfd5a
                                                                                                                              • Opcode Fuzzy Hash: ceb41b2cd961f35b79dfd21e906e001bb944daf11e699655d42e90cc4a1ee729
                                                                                                                              • Instruction Fuzzy Hash: 1301406140D3C45FD7128B259C94B62BFB4EF43224F1D81DBE9848F1A7C2699848C772
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Executed Functions

                                                                                                                              Function 00913E50 Relevance: 5.3, Strings: 4, Instructions: 316COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p$(p$(p$$p
                                                                                                                              • API String ID: 0-2108972344
                                                                                                                              • Opcode ID: 24f99a21c9d0f601efbe411dce8f996bd1ad83590778b7bce0b71dd9db7c8129
                                                                                                                              • Instruction ID: 5f56fb754d5366721163c3849a1db1063c1e97db545744468c235eac815cd53f
                                                                                                                              • Opcode Fuzzy Hash: 24f99a21c9d0f601efbe411dce8f996bd1ad83590778b7bce0b71dd9db7c8129
                                                                                                                              • Instruction Fuzzy Hash: 8CA1D830B0421D9BDB255B6998147EEBAB59FC8705F14843DE806D7385CB788D82C7D1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0091260C Relevance: 5.1, Strings: 4, Instructions: 134COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p$LRp$Z|$lY|
                                                                                                                              • API String ID: 0-2724501580
                                                                                                                              • Opcode ID: 9df934bec1fc385fd9ae23e47ddf6960a85f5a5ef5dc5600da3a595b8b088810
                                                                                                                              • Instruction ID: 3b91356b38f037aa97e54830a5562a68afc90bb2b843ffcbded8ea7b0690e7ef
                                                                                                                              • Opcode Fuzzy Hash: 9df934bec1fc385fd9ae23e47ddf6960a85f5a5ef5dc5600da3a595b8b088810
                                                                                                                              • Instruction Fuzzy Hash: 9241F3307042585FDB19AB38A8557BF3BABAFC5300F18886EE406C7399DF389D528791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00913798 Relevance: 2.8, Strings: 2, Instructions: 344COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p$rG
                                                                                                                              • API String ID: 0-1813966809
                                                                                                                              • Opcode ID: 28563cdc76bff897dafdad74fc969e6e9ae2d2e43b7b2f5d459f77ab60b4e384
                                                                                                                              • Instruction ID: a44bc2decc971cfc6d066949228cdb2a2f7b8b67433b1f0c2823cd173cd2630b
                                                                                                                              • Opcode Fuzzy Hash: 28563cdc76bff897dafdad74fc969e6e9ae2d2e43b7b2f5d459f77ab60b4e384
                                                                                                                              • Instruction Fuzzy Hash: 17D1B3707043098BD725DF24D890BAA77B6EF80304F14C969D446CB399DB75EE8AC791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00911630 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: $p$$p
                                                                                                                              • API String ID: 0-580715581
                                                                                                                              • Opcode ID: 4f9892da1e549e1c509fd66d535bd22aacc895577ed3947864f20e06e627ff0a
                                                                                                                              • Instruction ID: 147a82d5e704adbc243feec4e2c63f2ffac76befacf44259d2801493dc433721
                                                                                                                              • Opcode Fuzzy Hash: 4f9892da1e549e1c509fd66d535bd22aacc895577ed3947864f20e06e627ff0a
                                                                                                                              • Instruction Fuzzy Hash: F5510231B01208AFCB19DFB8D840AEEBBFABFC9350B14852AD504D7355DA308C56CBA0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00912B10 Relevance: 1.5, Strings: 1, Instructions: 225COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: fp
                                                                                                                              • API String ID: 0-3781980146
                                                                                                                              • Opcode ID: eeeb491c43900e7a18072a370ca741bb4884dd373bc3aa10e87c961f470fb209
                                                                                                                              • Instruction ID: db8462c72b0324d76e3a587d42757940fd3bdf650ddcb99922dbd2d0c0de5cd2
                                                                                                                              • Opcode Fuzzy Hash: eeeb491c43900e7a18072a370ca741bb4884dd373bc3aa10e87c961f470fb209
                                                                                                                              • Instruction Fuzzy Hash: 92711031B0061A9BCB15EBA4D4107AEBBA2AFC5300F148669E8069F295EF74DD96C780
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00911080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: cf2c8f220e3240eec53ce4aa6b4372b8400b3fc834d8e821d9bcc7141adab3af
                                                                                                                              • Instruction ID: 141e93806f8cd4ca6df5a2851d3a57ab858df0d7792a8d2f094226bfa831c6b4
                                                                                                                              • Opcode Fuzzy Hash: cf2c8f220e3240eec53ce4aa6b4372b8400b3fc834d8e821d9bcc7141adab3af
                                                                                                                              • Instruction Fuzzy Hash: 4671CA31B002189FDB089BB4C854BAEB7A7AFC8300F158529E506DB364DE75DD92C790
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00910C1C Relevance: 1.4, Strings: 1, Instructions: 154COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: f6a63705c1c3aa77ac55e0f64052595459890c09dbb5a773a951bb3b7d158cd4
                                                                                                                              • Instruction ID: 3b4b8d1793fa5fbff4ae437450a5e078639ba383bb9c852b7c0935f7bd805a2f
                                                                                                                              • Opcode Fuzzy Hash: f6a63705c1c3aa77ac55e0f64052595459890c09dbb5a773a951bb3b7d158cd4
                                                                                                                              • Instruction Fuzzy Hash: F2510530B04248AFD7199B74D824BEE7BF6AFC9300F14846EE506D7391CE795C868BA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00912B03 Relevance: 1.4, Strings: 1, Instructions: 152COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: fp
                                                                                                                              • API String ID: 0-3781980146
                                                                                                                              • Opcode ID: 6b38027e832ef465d1265f6caea439ac2bf49639fb4d0847c40a9fe1f9dbbe70
                                                                                                                              • Instruction ID: e1bd552d4d65aebcd485e9228946e41e30d298dca300c9560cb836e33e823b9f
                                                                                                                              • Opcode Fuzzy Hash: 6b38027e832ef465d1265f6caea439ac2bf49639fb4d0847c40a9fe1f9dbbe70
                                                                                                                              • Instruction Fuzzy Hash: A3511330B0064A9BDB15EF60D5117AEB7F6AFC1300F1485A9D8059F295EB70DCD6CB80
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00913550 Relevance: 1.4, Strings: 1, Instructions: 136COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: (p
                                                                                                                              • API String ID: 0-4175582459
                                                                                                                              • Opcode ID: 08e24f835585b89704e246274569228e6ef09c81b78bed6dd8430765ed81fb5b
                                                                                                                              • Instruction ID: adb46091725156c6b5cd2b69cfcdea983804d9eaea73cf84466d00cfc51a4347
                                                                                                                              • Opcode Fuzzy Hash: 08e24f835585b89704e246274569228e6ef09c81b78bed6dd8430765ed81fb5b
                                                                                                                              • Instruction Fuzzy Hash: 7F516D74F0061A9BDB09DFA9C459AEEBBF2AF88305F24C029D405A7354DB345A85CBA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00913795 Relevance: .1, Instructions: 134COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 215c146a098fc8378d310bfee3d0011850cbfc0cb449d6c789c81b7ff4b0b593
                                                                                                                              • Instruction ID: 516473833652581441433a83cc8e41206aa5936fa66dce9fbefbb958667f71f2
                                                                                                                              • Opcode Fuzzy Hash: 215c146a098fc8378d310bfee3d0011850cbfc0cb449d6c789c81b7ff4b0b593
                                                                                                                              • Instruction Fuzzy Hash: 41419170B0070A8FD725DF65C884BAAB7B6FF80310F54CA68D4159B299DB70EE85CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00912968 Relevance: .1, Instructions: 120COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 93cdc6cf0fa5b2830a9b5ac241ae2d431d64ba0f032d450463142362d01198b0
                                                                                                                              • Instruction ID: 26fd210891f03b31c7cf21fab93189c476a1c1d5a1fdfc55270255c7b28905c8
                                                                                                                              • Opcode Fuzzy Hash: 93cdc6cf0fa5b2830a9b5ac241ae2d431d64ba0f032d450463142362d01198b0
                                                                                                                              • Instruction Fuzzy Hash: 8A41B3347002085BD708B735E8907AEB3EBEFC4314F248529E815C7398DF759D628B94
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00913CC8 Relevance: .1, Instructions: 118COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0ca13e88cd5766f60f283c7aee124928d4e48b18446ffd4a79eec50371719990
                                                                                                                              • Instruction ID: 2169e611c6672427e31bc8d41bb9f6c2ebf1556b1c92723b56ce1bbd8291a996
                                                                                                                              • Opcode Fuzzy Hash: 0ca13e88cd5766f60f283c7aee124928d4e48b18446ffd4a79eec50371719990
                                                                                                                              • Instruction Fuzzy Hash: CB31FF32304318AFC715AB69E844BAA7BF9EF85321F10807EE84ACB291DB35DD45C790
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00912268 Relevance: .1, Instructions: 106COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0630bcb1183deea270863e33dec09c355fcf0abf15a8f0cf1c0cf4fc645493b6
                                                                                                                              • Instruction ID: ed0cbc8d1a03d91b7ae92734f5cceda3a2c6f36020e3c8a9c31d35f37d740e90
                                                                                                                              • Opcode Fuzzy Hash: 0630bcb1183deea270863e33dec09c355fcf0abf15a8f0cf1c0cf4fc645493b6
                                                                                                                              • Instruction Fuzzy Hash: 5C411A75B001189FCB54EF68D8809DEB7B6FF88710B148169E905EB365DB31DD92CB90
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00914115 Relevance: .1, Instructions: 77COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 1cbc6a64c5a34e146c4504019517b36753cfb81eca9cfe7f29513fa8280333c3
                                                                                                                              • Instruction ID: 1f43db36c72da97576095def02a12dc707bbc5e8e779ad7c6b780f3982d8c44e
                                                                                                                              • Opcode Fuzzy Hash: 1cbc6a64c5a34e146c4504019517b36753cfb81eca9cfe7f29513fa8280333c3
                                                                                                                              • Instruction Fuzzy Hash: 1721D170B0420C9BDB189BA5C458BEEBBF5AB9C314F10842EE515A7291CF780D868B91
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0091353F Relevance: .1, Instructions: 69COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 263b66b08b29845af395c4d68955f3a6c0e32d587dd9927d3eb749e8318e7942
                                                                                                                              • Instruction ID: 2befc151145145c83ab4fb4cff83053e405ff5c12542eab9f78237496227dda7
                                                                                                                              • Opcode Fuzzy Hash: 263b66b08b29845af395c4d68955f3a6c0e32d587dd9927d3eb749e8318e7942
                                                                                                                              • Instruction Fuzzy Hash: 5E21CF70B00619ABCB199B65C469BEEBBF2AF88741F14C428D406E3794CB348DC5CB92
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00912958 Relevance: .1, Instructions: 67COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 89a628141f982e4ed1c1910b807adcf6b3e38624e20e1a0c56f2a16629a1a822
                                                                                                                              • Instruction ID: e8dc9a3cf3fa607a0a9f9d43360aa14ef1861b90db38197a0f6a17c26e00a23b
                                                                                                                              • Opcode Fuzzy Hash: 89a628141f982e4ed1c1910b807adcf6b3e38624e20e1a0c56f2a16629a1a822
                                                                                                                              • Instruction Fuzzy Hash: 5711E630700308AFC705AB29D9406AEB7EEEFC5350B148479E815CB394EB35DD62C7A0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00912FE0 Relevance: .1, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b313df50bf9927dc58605f2ea104e0889fb621454db0302f629f4758acdb3ebf
                                                                                                                              • Instruction ID: 009252db6aca7a324c797862e43b14eeeee1b53d9ccb7dba391cd6c3cfcd9fbe
                                                                                                                              • Opcode Fuzzy Hash: b313df50bf9927dc58605f2ea104e0889fb621454db0302f629f4758acdb3ebf
                                                                                                                              • Instruction Fuzzy Hash: 93113334B00108AFDB04DB65D851AEE7BF6AFCC311F148029E405A7395DE75A9C6CB94
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00911958 Relevance: .1, Instructions: 56COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 606c9b346988727d7c2fd9b25962e319e0a0e89bad692ead141ec85d2be2147d
                                                                                                                              • Instruction ID: d84f09bed5a906f59aa8d17ca5860321296e6655053fff12ee94f91a9ffb55eb
                                                                                                                              • Opcode Fuzzy Hash: 606c9b346988727d7c2fd9b25962e319e0a0e89bad692ead141ec85d2be2147d
                                                                                                                              • Instruction Fuzzy Hash: CF113034604284AFCB08DB64D854EA97BB2FF8C311F14801DE41A97361CA7A69C6CBA4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00911378 Relevance: .1, Instructions: 55COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 512d689c46797b60bd0bc3f21060f2cde88b0d6651d1d8c2f08e10bb3ed070ef
                                                                                                                              • Instruction ID: a7315e43109949f39866ac3146fd21c3bc6ad3a9a6903dd2e4111f0f3c711da4
                                                                                                                              • Opcode Fuzzy Hash: 512d689c46797b60bd0bc3f21060f2cde88b0d6651d1d8c2f08e10bb3ed070ef
                                                                                                                              • Instruction Fuzzy Hash: 80210474D002099FDB10DFAAC484AEEFBF4EF48324F14852ED51967250C774A945CFA1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00911380 Relevance: .1, Instructions: 53COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 2d7594f433a6977c37c221fa3af3cbef0fcb221385f9dad6807ab9f19e88acf8
                                                                                                                              • Instruction ID: 165014584be9f9a3d504ccb78002bec60067a150f27f9b50003dc2092f3c226f
                                                                                                                              • Opcode Fuzzy Hash: 2d7594f433a6977c37c221fa3af3cbef0fcb221385f9dad6807ab9f19e88acf8
                                                                                                                              • Instruction Fuzzy Hash: CE11F475D002099BDB10DFAAC884BEEFBF4FF88324F10842AD91967250C774A945CFA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00911968 Relevance: .1, Instructions: 51COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 94528e624970ab3735f37f0926ed2e0c635b2f723fa3c587e13cbe0d85bca28d
                                                                                                                              • Instruction ID: 470cb9c17f7f2b745f750cf875da7a43fcdab7cf9b98696a2bf0565501f9d2aa
                                                                                                                              • Opcode Fuzzy Hash: 94528e624970ab3735f37f0926ed2e0c635b2f723fa3c587e13cbe0d85bca28d
                                                                                                                              • Instruction Fuzzy Hash: 31110035600644AFC708DF64D854EA97BB6FF8C311F14801DE50AE7364CB7AA9C5CBA4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001BD006 Relevance: .0, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000002.625271990.00000000001BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001BD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_2_1bd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 855cca5b5160f90f2822330c41d6e2eb29de1e16333eae76a29f95336d25548d
                                                                                                                              • Instruction ID: 9b79d40fdda600c449ce224a1771fd00619f4be0aa1b0bf6e8a77a95fd44c5dc
                                                                                                                              • Opcode Fuzzy Hash: 855cca5b5160f90f2822330c41d6e2eb29de1e16333eae76a29f95336d25548d
                                                                                                                              • Instruction Fuzzy Hash: CB016D6140D3C09FD7164B259C947A2BFA8DF53224F1984DBE8848F1A7D3699C49C771
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00914158 Relevance: .0, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: f1fc2112a8e611e78f58bd86b3e82c44e4fff953368de941a2d13434eb0ed127
                                                                                                                              • Instruction ID: 192706366829c6ef65d2f2f502d80bfd3a5f3abfa8197525a4d189263f2ce3be
                                                                                                                              • Opcode Fuzzy Hash: f1fc2112a8e611e78f58bd86b3e82c44e4fff953368de941a2d13434eb0ed127
                                                                                                                              • Instruction Fuzzy Hash: BB015270F1021CABDB149AA9D454BDEBAF9ABDC310F108439E411B7280DF745D858BA5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 001BD01D Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000002.625271990.00000000001BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001BD000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_2_1bd000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 290db31db01a2ece38e3670196be6321f8e252ca798d62955be56a16cf7efcc7
                                                                                                                              • Instruction ID: fcbf3a81f17e2c2b62f5d5e89dba673b7f66c72bf404e170702fa6fb924da956
                                                                                                                              • Opcode Fuzzy Hash: 290db31db01a2ece38e3670196be6321f8e252ca798d62955be56a16cf7efcc7
                                                                                                                              • Instruction Fuzzy Hash: 8801F771404340AAE7186E25E8C4BA7BFD8DF41324F28C41AFC494B286D779D845CAB1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 0091182C Relevance: .0, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 45e88b11a2dcde854d9e5f795cc62c8d55965670802587f6e9629536c3987c60
                                                                                                                              • Instruction ID: 06e16e3a11f88e437b3f14b0eb2f66eabe1fce63fa8cc4984baa25b0bbd18c6e
                                                                                                                              • Opcode Fuzzy Hash: 45e88b11a2dcde854d9e5f795cc62c8d55965670802587f6e9629536c3987c60
                                                                                                                              • Instruction Fuzzy Hash: 4D01F931B1010CA7D718A66984157FF7AFB9BC8300F1484ADE206F3381CEB64D818BE1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00911440 Relevance: .0, Instructions: 37COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: bd23dff912208d6482bbbde78409e90eb9f78680e16719c94d2cd169f75f449f
                                                                                                                              • Instruction ID: b2b2350fbb7ce30cb831b33d3039826e1bf984d298902cbc93fe87c369a8c678
                                                                                                                              • Opcode Fuzzy Hash: bd23dff912208d6482bbbde78409e90eb9f78680e16719c94d2cd169f75f449f
                                                                                                                              • Instruction Fuzzy Hash: 6BF0A9307053465FC70DDB38A8B5B397FA9AEC2700B0904BEC146CF2B5DD195884C791
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00911431 Relevance: .0, Instructions: 34COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c14caef5609854d41f4f1c39dd84e9a95dd35db1d93be28cbd234ff780420d48
                                                                                                                              • Instruction ID: c019f401040f3ce5b31f9056441a684e7dbeeeae574b8ab3b0d07b7dfcf33bb6
                                                                                                                              • Opcode Fuzzy Hash: c14caef5609854d41f4f1c39dd84e9a95dd35db1d93be28cbd234ff780420d48
                                                                                                                              • Instruction Fuzzy Hash: 5EF0963070120A5ED709DB78A865B7A7BDAAFC1750B05047D8206CF2B4ED2598C0D7D5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00913E40 Relevance: .0, Instructions: 34COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 69047531f6dec54e748ab6887532cb0115b35a37af565de66460ee2a3e4f0e35
                                                                                                                              • Instruction ID: e1ad17c9208fed44ca5610ab08d3aef443fa34d0344b772e1cf4621c11fe23f6
                                                                                                                              • Opcode Fuzzy Hash: 69047531f6dec54e748ab6887532cb0115b35a37af565de66460ee2a3e4f0e35
                                                                                                                              • Instruction Fuzzy Hash: 70E0E571B1C3986FC312025E2C249977FBD9BC767431941ABF508C72E699158D05C2A6
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00911050 Relevance: .0, Instructions: 27COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 07cf3d872bde635b506dcd5dba48884affe0760723b77b00c0b8418da5661bbd
                                                                                                                              • Instruction ID: 6848815d6495db39fbdf20f9ab45d9e7e9ca42c858db893e44a1eb1b565dcbd6
                                                                                                                              • Opcode Fuzzy Hash: 07cf3d872bde635b506dcd5dba48884affe0760723b77b00c0b8418da5661bbd
                                                                                                                              • Instruction Fuzzy Hash: 3BE06D3030071CABC725B729E444BAE37E9EFC1311B804D3DE10687285CB64AC5A4385
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00912F88 Relevance: .0, Instructions: 25COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: ded7f12f0b5b7de8684b4aa23b0c815c22994cdb4f15bda582856428ecd03c4a
                                                                                                                              • Instruction ID: 34d61486d443b9b203708f3c9ad8ad72863ecd502adc9c7cd9df420ed811d707
                                                                                                                              • Opcode Fuzzy Hash: ded7f12f0b5b7de8684b4aa23b0c815c22994cdb4f15bda582856428ecd03c4a
                                                                                                                              • Instruction Fuzzy Hash: 35E09A3634011CBBCF013A84A800BEA7BAAEB84360F408025FE0845220C63288F0E790
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 009117F0 Relevance: .0, Instructions: 21COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c6382ef95e445999b5cf29ecdb830e205c3e9afd8c910d081fdf6b1cbfd774bf
                                                                                                                              • Instruction ID: a5c62ebc58263dceb419dfcb4120161341ff2f02c921a53dda6f76d04ad18d0c
                                                                                                                              • Opcode Fuzzy Hash: c6382ef95e445999b5cf29ecdb830e205c3e9afd8c910d081fdf6b1cbfd774bf
                                                                                                                              • Instruction Fuzzy Hash: 5AE0C23621A3AC5FC3021B10AC105963F7CAB8A25131440A7F441C72B2CE711D65C7E5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00910C0C Relevance: .0, Instructions: 17COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 0bc6e6685df47fd073ad3b0de7c63999b6d189affb79348eb6415c18570fa1c4
                                                                                                                              • Instruction ID: 2812bf40df1ef4d840305a2ba05650b35749eb2ff7c491cdb0aae15b417eeebd
                                                                                                                              • Opcode Fuzzy Hash: 0bc6e6685df47fd073ad3b0de7c63999b6d189affb79348eb6415c18570fa1c4
                                                                                                                              • Instruction Fuzzy Hash: FAD0A73231152CAB43156618E885BAA775DEB853613504837F90283225CE756C9687D5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00910440 Relevance: .0, Instructions: 11COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000021.00000003.625127535.0000000000910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00910000, based on PE: false
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_33_3_910000_rundll32.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: bc7885eb42c20d03d3f695b321bf4203190e297116ccfe9d9256f0b417531206
                                                                                                                              • Instruction ID: 711cdb3a0a8c84d6a033055b66a54fc7622eb718b082f2c57d38d5938b6c3f3c
                                                                                                                              • Opcode Fuzzy Hash: bc7885eb42c20d03d3f695b321bf4203190e297116ccfe9d9256f0b417531206
                                                                                                                              • Instruction Fuzzy Hash: 2FC012B26256848ECA068654A484BA077A4BF62304F8992BAC1404A232E21A8882AB94
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%